Filesystem Entitlement Bypass in Docker Buildx by Docker
CVE-2026-121542

1.8LOW

Key Information:

Vendor

Docker

Status
Docker Buildx
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121542?

In certain versions of Docker Buildx (v0.19.0 to v0.38.0), an untrusted Bake definition can potentially expose files to the Buildx client without the necessary filesystem entitlement checks. This vulnerability allows specific file paths, particularly those matching the current working directory, to evade security mechanisms if they follow particular naming conventions. Users who execute untrusted Bake definitions are especially at risk, as they may inadvertently expose sensitive files. Docker addressed this issue in version v0.38.1.

Affected Version(s)

Docker Buildx 0.19.0 < 0.38.1

References

https://github.com/docker/buildx/security/advisories/GHSA...
vendor-advisory

CVSS V4

Score:
1.8
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hCaptcha security team
.