{"id":"CVE-2026-121541","kind":"vulnerability","aliases":["CVE-2026-121541"],"related":[],"title":"Docker Buildx: untrusted Bake files can read host files without approval","description":"In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.","summary":"In Docker Buildx v0.19.0 through v0.38.0, a Bake definition that builds multiple targets together can expose files on the machine without the expected fs.read approval. An attacker who supplies an untrusted Bake definition can read files the Buildx client can access.","severity":"medium","cvss":5.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bake","buildx","ci","docker","package"],"not_affected_if":["buildx-outside-affected-range","trusted-bake-files-only"],"how_to_check":"- Run `docker buildx version` and compare against the affected range `v0.19.0` through `v0.38.0`\n- Check whether builds run Bake definitions from untrusted sources\n- Review whether `fs.read` entitlements are granted to builds","fix":null,"status":"open","published_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","triaged_at":"2026-11-03T23:16:14+00:00","updated_at":"2026-11-03T23:16:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T23:16:14Z","model":"claude-haiku-5-5","output":{"fix":"- Docker Buildx: move to `v0.38.1`","reach":"local","title":"Docker Buildx: untrusted Bake files can read host files without approval","impact":"medium","summary":"In Docker Buildx v0.19.0 through v0.38.0, a Bake definition that builds multiple targets together can expose files on the machine without the expected fs.read approval. An attacker who supplies an untrusted Bake definition can read files the Buildx client can access.","audience":"developers","category":"package","nicknames":[],"who_cares":["docker","buildx","bake","ci"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"local files readable by the Buildx client are exposed","analyst_note":"","how_to_check":"- Run `docker buildx version` and compare against the affected range `v0.19.0` through `v0.38.0`\n- Check whether builds run Bake definitions from untrusted sources\n- Review whether `fs.read` entitlements are granted to builds","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-bake-files-only","buildx-outside-affected-range"],"who_is_affected":"Teams whose Buildx client runs Bake definitions from sources they do not trust, especially multi-target builds. Teams that only build their own trusted Bake files are at lower risk. The sources do not say whether CI-only or default configurations differ.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4181,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121541':14A,17A '-2026':13A,16A 'access':63B,83C 'affect':116C 'approv':11A,47B,92C,106C 'attack':49B 'bake':4A,18B,30B,54B,73C,112C 'build':33B,76C 'buildx':2A,19B,25B,60B,66C,86C 'certain':94C 'ci':20B 'client':61B,87C 'condit':95C 'cve':12A,15A 'definit':31B,55B,74C,113C 'docker':1A,21B,24B,65C 'entitl':107C 'expect':45B,90C 'expos':38B,81C 'file':5A,9A,39B,58B,82C 'filesystem':96C 'fix':120C 'fs.read':46B,91C 'host':8A 'issu':118C 'machin':42B 'may':80C,114C 'multipl':34B,77C 'packag':22B 'path':97C 'read':7A,57B 'run':110C 'suppli':51B 'target':35B,78C,100C 'togeth':36B,79C 'untrust':3A,53B,72C,111C 'user':108C 'v0.19.0':26B,68C 'v0.38.0':28B,70C 'v0.38.1':122C 'verifi':103C 'version':67C 'without':10A,43B,88C","nicknames":[],"mitigations":[],"who_affected":"Teams whose Buildx client runs Bake definitions from sources they do not trust, especially multi-target builds. Teams that only build their own trusted Bake files are at lower risk. The sources do not say whether CI-only or default configurations differ.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bake","buildx","ci","docker","medium","package"],"campaign_type":null,"first_public_at":"2026-11-03T19:27:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121541","severity":null,"published_at":"2026-11-03T22:19:46+00:00","modified_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","fetched_at":"2026-11-03T23:15:09+00:00","note":null}],"documents":[{"id":61392,"url":"https://github.com/docker/buildx/security/advisories/GHSA-xg6v-cv2h-2w5h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T19:27:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}