CVE-2026-93325 Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx

Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped...

CVE-2026-93325

A protection mechanism failure in Docker Buildx allows for remote code execution (RCE) by failing to properly enforce filesystem entitlements. The vulnerability specifically occurs when processing bake definition files ; when the --progress=rawjson flag is used, the mandatory consent step (normal...