---
id: "CVE-2026-121542"
kind: "vulnerability"
aliases: ["CVE-2026-121542"]
title: "Docker Buildx: untrusted Bake files can read sibling paths without approval"
severity: "low"
cvss: 1.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "developers", "docker", "docker-buildx", "package"]
not_affected_if: ["buildx-outside-v0.19-v0.38", "trusted-bake-files-only"]
published_at: "2026-11-03T22:19:46+00:00"
first_seen_at: "2026-11-03T23:15:09+00:00"
updated_at: "2026-11-03T23:16:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121542", "first_seen_at": "2026-11-03T23:15:09+00:00"}]
---

# Docker Buildx: untrusted Bake files can read sibling paths without approval

Docker Buildx v0.19.0 through v0.38.0 can let an untrusted Bake definition read files that should need fs.read approval. The check is skipped for paths beside the working directory whose names start with the working directory's basename.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `docker buildx version` and check whether the version is between `v0.19.0` and `v0.38.0`.
- Look for a Bake definition from an untrusted source that you run with `docker buildx bake`.

## Timeline

- 2026-11-03T23:15:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121542

## Documents

- [advisory] Vendor advisory: github.com https://github.com/docker/buildx/security/advisories/GHSA-rghq-x9hf-hc3r

## From the sources

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_