CVE-2026-121541Medium· 5.6▾ SunlitIn Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, files…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.
buildx >= 0.19.0 < 0.38.1Upgrade Docker Buildx to v0.38.1 or later.
Run only trusted Bake definitions until upgrading. Check that Bake definitions do not contain suspicious paths outside trusted directories.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121542Low· 1.8Bake filesystem path entitlements approval can be skipped for path using basename prefix
CVE-2026-103433Medium· 6.9Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs
CVE-2026-112917Critical· 9.2Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
CVE-2026-121614High· 7.1Docker Sandboxes host Git executes repository-controlled programs
CVE-2026-93325High· 7.3Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx
CVE-2026-103916High· 8.4Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory