Filesystem Exposure in Docker Buildx Bake by Docker Inc.

CVE-2026-103433

What is CVE-2026-103433?

Docker Buildx Bake is vulnerable due to a flaw where certain filesystem inputs are not properly validated. This issue arises when users run untrusted Bake definitions, which can inadvertently expose accessible files through pathless secrets. Furthermore, it allows access to local OCI image layouts beyond the intended project scope, posing a significant risk to users who may have modified entitlement validation checks. It is essential for users to adopt best practices regarding trust and validation when utilizing Bake definitions.

References