{"id":"CVE-2026-93325","kind":"vulnerability","aliases":["CVE-2026-93325"],"related":[],"title":"Docker Buildx: bake build can skip entitlement consent, reaching outside the working directory","description":"Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.","summary":"Docker Buildx bake normally asks for explicit permission (via --allow or an interactive prompt) before a build can access files outside the working directory. When run with --progress=rawjson, that consent step is skipped, so a build can reach beyond its directory without approval.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/docker/buildx","fixed":["0.37.2"],"affected":">= 0.21.0, < 0.37.2","ecosystem":"go"}],"ecosystems":[],"tags":["bake","buildx","ci","docker","docker-build","package"],"not_affected_if":["default-progress-output","no-bake-usage","trusted-build-definitions"],"how_to_check":"- Run `docker buildx version`. Buildx 0.21.0 up to but not including 0.37.2 is affected (the advisory patched-versions field says None, but its text and the release notes name v0.37.2 as the fix).\n- Search CI scripts and pipelines for `docker buildx bake` with `--progress=rawjson`, especially on build definitions you do not control. Other progress modes still run the consent gate, so switching away from rawjson is the workaround if you cannot upgrade.","fix":"Upgrade Docker Buildx to v0.37.2 or later. Bake with --progress=rawjson then rejects ungranted entitlements; grant what you need explicitly with --allow.","status":"open","published_at":"2026-11-03T20:18:19+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:50:16+00:00","updated_at":"2026-11-03T21:02:16+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-03T20:50:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Docker Buildx: bake build can skip entitlement consent, reaching outside the working directory","impact":"medium","summary":"Docker Buildx bake normally asks for explicit permission (via --allow or an interactive prompt) before a build can access files outside the working directory. When run with --progress=rawjson, that consent step is skipped, so a build can reach beyond its directory without approval.","audience":"developers","category":"package","nicknames":[],"who_cares":["docker","buildx","bake","ci","docker-build"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"build reads or writes files outside the working directory without consent","analyst_note":"Find the affected and fixed Buildx versions in the release notes linked from the NVD entry (github.com docker/buildx).","how_to_check":"- Run `docker buildx version` and compare against the fixed version in the release notes.\n- Look in CI scripts and build pipelines for `docker buildx bake` used with `--progress=rawjson` on untrusted build definitions.","plain_action":"","needs_analyst":true,"not_affected_if":["no-bake-usage","trusted-build-definitions","default-progress-output"],"who_is_affected":"Teams that run `docker buildx bake` in CI or on developer machines, especially with build definitions from untrusted sources or with --progress=rawjson. Builds that never use bake, or that only use trusted definitions without rawjson progress output, are less exposed. The sources do not state the affected version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4113,"output_tokens":565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Buildx versions in the release notes linked from the NVD entry (github.com docker/buildx).","search":"'-2026':15A,18A '-93325':16A,19A '/docker/buildx':22A 'access':49B 'allow':40B,84C 'approv':74B 'ask':35B 'bake':3A,23B,33B,76C 'beyond':70B 'build':4A,29B,47B,67B,91C 'buildx':2A,24B,32B,75C 'ci':25B 'consent':8A,61B,101C 'cve':14A,17A 'directori':13A,54B,72B,96C 'docker':1A,26B,28B,31B 'docker-build':27B 'entitl':7A,82C 'explicit':37B 'file':50B 'github.com':21A 'github.com/docker/buildx':20A 'grant':81C 'interact':43B,87C 'normal':34B 'outsid':10A,51B,93C 'packag':30B 'permiss':38B 'progress':58B,98C 'prompt':44B,88C 'rawjson':59B,99C 'reach':9A,69B,92C 'requir':77C 'run':56B 'skip':6A,64B,104C 'step':62B,102C 'user':79C 'via':39B 'without':73B 'work':12A,53B,95C","nicknames":[],"mitigations":[],"who_affected":"Teams running docker buildx bake, version 0.21.0 to before 0.37.2, with --progress=rawjson. In that mode the --allow / interactive consent check is skipped, so a build definition can reach files outside the working directory without approval. CI pipelines that read bake files from untrusted sources (PRs, third-party repos) matter most. You can skip it if you do not use bake, use other progress modes, or only build trusted definitions.","tier":"B","verified":{"fix":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/docker/buildx/releases/tag/v0.37.2","run_id":1560},"products":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/docker/buildx/releases/tag/v0.37.2","run_id":1560},"how_to_check":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/docker/buildx/releases/tag/v0.37.2","run_id":1560},"who_affected":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/docker/buildx/releases/tag/v0.37.2","run_id":1560}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomdockerbuildx"],"ptokens":["buildx","com","docker","github"],"labels":["bake","buildx","ci","docker","dockerbuild","high","package"],"campaign_type":null,"first_public_at":"2026-09-30T18:48:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93325","severity":null,"published_at":"2026-11-03T20:18:19+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93325:1560","url":null,"severity":null,"published_at":"2026-11-03T21:02:16+00:00","modified_at":"2026-11-03T21:02:16+00:00","first_seen_at":"2026-11-03T21:02:16+00:00","fetched_at":"2026-11-03T21:02:16+00:00","note":"Read vendor GHSA-gwr2-q96m-6682 and v0.37.2 release notes: affected >=0.21.0, fixed 0.37.2 (GHSA patched: None field contradicts its own text). Sibling GHSA-p54p-jq4x-rc28 fixed in same release. No PoC or exploitation seen; social search skipped (low-profile local issue)."}],"documents":[{"id":60625,"url":"https://github.com/docker/buildx/releases/tag/v0.37.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60626,"url":"https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-30T18:48:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}