Multiple Target Exposure Vulnerability in Docker Buildx by Docker
CVE-2026-121541

5.6MEDIUM

Key Information:

Vendor

Docker

Status
Docker Buildx
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121541?

In specific versions of Docker Buildx, a vulnerability exists that arises when processing untrusted Bake definitions, allowing for the unauthorized exposure of files. This situation occurs without the necessary permissions being verified, potentially allowing sensitive information to be rendered accessible. Users executing untrusted Bake definitions are particularly vulnerable. The issue has been addressed in version 0.38.1, underscoring the importance of updating to the latest version to mitigate potential risks.

Affected Version(s)

Docker Buildx 0.19.0 < 0.38.1

References

https://github.com/docker/buildx/security/advisories/GHSA...
vendor-advisory

CVSS V4

Score:
5.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hCaptcha security team
.