CVE-2025-0495 Secrets leakage to telemetry endpoint via cache backend configuration via buildx

🗓️ 17 Mar 2025 19:21:11Reported by DockerType

CVE-2025-0495 allows secrets leakage to telemetry via cache backend configuration in Buildx.

Reporter	Title	Published	Views	Family All 61
Tenable Nessus	Azure Linux 3.0 Security Update: docker-buildx (CVE-2025-0495)	11 Jul 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: docker-buildx / moby-buildx (CVE-2025-0495)	11 Jul 202500:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : docker (SUSE-SU-2025:02289-1)	11 Jul 202500:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : docker (SUSE-SU-2025:02289-2)	17 Jul 202500:00	–	nessus
Tenable Nessus	SUSE SLES12 Security Update : docker (SUSE-SU-2025:1341-1)	18 Apr 202500:00	–	nessus
Tenable Nessus	SUSE SLES12 Security Update : docker-stable (SUSE-SU-2025:1344-1)	18 Apr 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-0495	18 Aug 202500:00	–	nessus
BDU FSTEC	The vulnerability of the Docker buildx plugin, related to the disclosure of information through registration files, allows a perpetrator to gain unauthorized access to protected information.	9 Jun 202500:00	–	bdu_fstec
CBLMariner	CVE-2025-0495 affecting package moby-buildx for versions less than 0.7.1-25	10 Jul 202515:07	–	cbl_mariner
CBLMariner	CVE-2025-0495 affecting package docker-buildx for versions less than 0.14.0-5	28 May 202521:14	–	cbl_mariner

[
  {
    "defaultStatus": "unaffected",
    "packageName": "buildx",
    "product": "buildx",
    "repo": "https://github.com/docker/buildx",
    "vendor": "docker",
    "versions": [
      {
        "lessThanOrEqual": "0.21.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/docker/buildx

17 Mar 2025 19:21Current

CVSS 44.1

EPSS0.00059

CWE-532