CVE-2026-121541

In Docker Buildx versions v0.19.0 through v0.38.0 , an untrusted Bake definition building multiple targets can expose files to the Buildx client without required fs.read approval. The root cause is that filesystem paths from certain targets are not consistently verified against approved entitleme...

Docker Buildx Filesystem Entitlements Protection Mechanism Failure Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Docker Buildx. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of ba...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the collectLocalPaths function in bake/entitlements.go, which did not resolve local OCI layout context paths and collected read-only secret paths from secret.FilePath rather than the resolved source, so neither...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the collectLocalPaths function in bake/entitlements.go, which did not resolve local OCI layout context paths and collected read-only secret paths from secret.FilePath rather than the resolved source, so neither...