CVE-2026-121541
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-11-03
Modified: 2026-11-06
First seen: 2026-11-03
Status: active
Attack Surface
Low Complexity
No Auth
Conf. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Active
S:
X
AT:
Present
VC:
High
VI:
None
VA:
None
Description
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Docker | Docker Buildx | 0.19.0 < 0.38.1 |
| Docker | Docker Buildx | 0.19.0 < 0.38.1 |