---
id: "CVE-2026-121541"
kind: "vulnerability"
aliases: ["CVE-2026-121541"]
title: "Docker Buildx: untrusted Bake files can read host files without approval"
severity: "medium"
cvss: 5.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bake", "buildx", "ci", "docker", "package"]
not_affected_if: ["buildx-outside-affected-range", "trusted-bake-files-only"]
published_at: "2026-11-03T22:19:46+00:00"
first_seen_at: "2026-11-03T23:15:09+00:00"
updated_at: "2026-11-03T23:16:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121541", "first_seen_at": "2026-11-03T23:15:09+00:00"}]
---

# Docker Buildx: untrusted Bake files can read host files without approval

In Docker Buildx v0.19.0 through v0.38.0, a Bake definition that builds multiple targets together can expose files on the machine without the expected fs.read approval. An attacker who supplies an untrusted Bake definition can read files the Buildx client can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `docker buildx version` and compare against the affected range `v0.19.0` through `v0.38.0`
- Check whether builds run Bake definitions from untrusted sources
- Review whether `fs.read` entitlements are granted to builds

## Timeline

- 2026-11-03T23:15:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121541

## Documents

- [advisory] Vendor advisory: github.com https://github.com/docker/buildx/security/advisories/GHSA-xg6v-cv2h-2w5h

## From the sources

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_