CVE-2026-121541 in Buildx
Summary
by MITRE • 11/04/2026
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified within Docker Buildx versions ranging from v0.19.0 through v0.38.0 represents a critical failure in access control enforcement during the execution of multi-target build definitions using the Bake feature. This flaw allows an untrusted user or process to construct a bake definition that, when executed by a privileged client, results in the exposure of files and directories on the host filesystem that should remain inaccessible under normal security policies. The core technical issue stems from insufficient validation logic within the Buildx engine when processing complex build instructions involving multiple targets simultaneously. Specifically, while individual file read operations are typically gated behind explicit entitlements requiring user approval or configuration-based permissions, this specific scenario bypasses those checks by exploiting inconsistencies in how filesystem paths associated with different build targets are verified against the approved security boundaries.
From a technical perspective, Docker Buildx utilizes an entitlement system to restrict what actions a builder can perform on the host machine, such as accessing sensitive files or mounting network interfaces. These entitlements act as a whitelist of allowed operations designed to prevent container breakout and unauthorized data exfiltration. In this vulnerability, when multiple targets are defined in a single bake file, the engine fails to consistently apply these path verification checks across all components of the build graph. This inconsistency creates a side-channel effect where paths intended for one target may inadvertently inherit or expose access rights meant for another, or simply fail to be checked against the global entitlements at all. Consequently, an attacker who can supply a malicious bake definition can trick the Buildx client into reading arbitrary files from the host filesystem without triggering the expected security prompts or permission denials.
The operational impact of this vulnerability is significant, particularly in environments where build automation tools are used with varying levels of trust. If a developer or CI/CD pipeline processes an untrusted bake file, such as one downloaded from a public repository or submitted by an external contributor without rigorous review, the Buildx client may inadvertently expose sensitive configuration files, source code secrets, SSH keys, or other critical data residing on the host machine. This constitutes a severe confidentiality breach and aligns with common attack patterns involving unauthorized access to local resources via containerized build processes. The risk is exacerbated in shared development environments where multiple users interact with the same Docker daemon, as one user could potentially leverage this flaw to read another user's private files if they share the same execution context or entitlement scope.
This vulnerability maps directly to CWE-200, which classifies information exposure resulting from improper access control mechanisms that fail to restrict data retrieval appropriately. Furthermore, it relates to CWE-732, describing incorrect permission assignment for critical resources, as the system fails to enforce the intended restrictions on file paths during the build process. In terms of MITRE ATT&CK framework alignment, this flaw facilitates techniques associated with T1083, File and Directory Discovery, where an adversary explores local systems to gather information necessary for further exploitation or data staging. The lack of proper validation against entitlements also reflects weaknesses in input validation logic often seen in complex software architectures handling untrusted inputs.
To mitigate the risks associated with this vulnerability, organizations must immediately upgrade Docker Buildx to version v0.38.1 or later, where the path verification logic has been corrected to ensure all filesystem accesses are consistently checked against approved entitlements regardless of how many targets are defined in a bake file. In environments where upgrading is not instantly feasible, administrators should enforce strict policies regarding untrusted build definitions by disabling remote context loading for non-privileged users and ensuring that only trusted sources can trigger multi-target builds. Additionally, implementing least privilege principles for the Docker daemon user account limits the potential blast radius of any successful exploitation attempt. Regular auditing of bake files in CI/CD pipelines using static analysis tools designed to detect suspicious file access patterns can also provide an additional layer of defense against this class of vulnerabilities.