CVE-2026-103433: Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who run untrusted Docker Buildx Bake definitions are affected. The issue is relevant where those definitions can reference filesystem inputs available to the Buildx client.
What must an attacker do to exploit it?
An attacker needs to provide a Bake definition that a user runs. The definition can use a pathless secret whose ID is interpreted as a client-side pathname, or reference a local OCI image layout outside the project using a path representation that differs from the one validated.
What can be exposed or accessed?
A readable local file can be exposed through the pathless-secret behavior. A malicious definition may also consume a local OCI image layout located outside the project.
What should teams do while evaluating a fix?
Do not run Bake definitions from untrusted sources. Review Bake definitions before execution for pathless secret definitions and local OCI layout references, especially references that may resolve outside the intended project directory.