{"id":"CVE-2026-121542","kind":"vulnerability","aliases":["CVE-2026-121542"],"related":[],"title":"Docker Buildx: untrusted Bake files can read sibling paths without approval","description":"In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.","summary":"Docker Buildx v0.19.0 through v0.38.0 can let an untrusted Bake definition read files that should need fs.read approval. The check is skipped for paths beside the working directory whose names start with the working directory's basename.","severity":"low","cvss":1.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","developers","docker","docker-buildx","package"],"not_affected_if":["buildx-outside-v0.19-v0.38","trusted-bake-files-only"],"how_to_check":"- Run `docker buildx version` and check whether the version is between `v0.19.0` and `v0.38.0`.\n- Look for a Bake definition from an untrusted source that you run with `docker buildx bake`.","fix":null,"status":"open","published_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","triaged_at":"2026-11-03T23:16:18+00:00","updated_at":"2026-11-03T23:16:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T23:16:18Z","model":"claude-haiku-5-5","output":{"fix":"- Docker Buildx: move to `v0.38.1`.","reach":"local","title":"Docker Buildx: untrusted Bake files can read sibling paths without approval","impact":"low","summary":"Docker Buildx v0.19.0 through v0.38.0 can let an untrusted Bake definition read files that should need fs.read approval. The check is skipped for paths beside the working directory whose names start with the working directory's basename.","audience":"developers","category":"package","nicknames":[],"who_cares":["docker-buildx","docker","ci","developers"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Files readable by Buildx, outside the approved path, are exposed to the Bake definition.","analyst_note":"","how_to_check":"- Run `docker buildx version` and check whether the version is between `v0.19.0` and `v0.38.0`.\n- Look for a Bake definition from an untrusted source that you run with `docker buildx bake`.","plain_action":"","needs_analyst":false,"not_affected_if":["buildx-outside-v0.19-v0.38","trusted-bake-files-only"],"who_is_affected":"Teams that run Docker Buildx Bake definitions they did not write or do not trust. Exploitation needs matching filenames next to the current project directory, so routine builds of your own projects are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000674,"input_tokens":4216,"output_tokens":505,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-121542':14A,17A '-2026':13A,16A 'access':76C 'affect':136C 'approv':11A,42B,85C 'bake':4A,34B,71C,132C 'basenam':61B,107C 'besid':49B 'buildx':2A,23B,26B,64C,79C 'certain':87C 'check':44B,116C 'ci':18B 'client':80C 'condit':88C 'current':97C,125C 'cve':12A,15A 'definit':35B,72C,133C 'develop':19B 'directori':52B,59B,94C,99C,105C,127C 'docker':1A,20B,22B,25B,63C 'docker-buildx':21B 'entitl':115C 'expect':83C 'exploit':117C 'expos':74C 'file':5A,37B,75C 'filenam':121C 'filesystem':114C 'fix':140C 'fs.read':41B,84C 'issu':138C 'let':31B 'match':120C 'may':73C,134C 'name':54B,101C 'need':40B 'next':122C 'packag':24B 'parent':93C 'path':9A,48B,89C 'prefix':110C 'project':126C 'read':7A,36B 'requir':118C 'run':130C 'sibl':8A 'skip':46B,112C 'specif':119C 'start':55B 'untrust':3A,33B,70C,131C 'use':102C 'user':128C 'v0.19.0':27B,66C 'v0.38.0':29B,68C 'v0.38.1':142C 'version':65C 'whose':53B,100C 'without':10A,81C 'work':51B,58B,98C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Docker Buildx Bake definitions they did not write or do not trust. Exploitation needs matching filenames next to the current project directory, so routine builds of your own projects are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","developers","docker","dockerbuildx","low","package"],"campaign_type":null,"first_public_at":"2026-11-03T19:26:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121542","severity":null,"published_at":"2026-11-03T22:19:46+00:00","modified_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","fetched_at":"2026-11-03T23:15:09+00:00","note":null}],"documents":[{"id":61395,"url":"https://github.com/docker/buildx/security/advisories/GHSA-rghq-x9hf-hc3r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T19:26:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}