CVE-2026-121541
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds…
- Risk score
- 44/100
- CVSS
- 5.6 v4.0
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. …
- Affected
- See advisory
- Fix
- Upgrade the product to 0.38.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.6 medium
- On your watchlist: docker
References
Original description
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.
Last activity 3 Nov 2026. Patch Forecast updates every hour.