CVE-2026-121542
LowCVSS 1.8Summary
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. The issue is fixed in v0.38.1.
Risk Assessment
Running untrusted Bake definitions may lead to unauthorized disclosure of files from the user's filesystem.
Recommendation
Update Docker Buildx to v0.38.1 or later and avoid running untrusted Bake definitions.
Other vulnerabilities in Docker Buildx
See all- CVE-2026-121541Medium
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against approved entitlements.
- CVE-2026-103433Medium
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation.
Original NVD description (English source)
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS