CVE-2026-121541: Bake filesystem path entitlements approval can be skipped in some multi-target builds
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docker Buildxto a version that resolves this vulnerability.Fixed in v0.38.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users running untrusted Bake definitions are affected, specifically when those definitions build multiple targets together. The exposure is limited to files that are accessible to the Buildx client.
What does an attacker need to exploit it?
An attacker needs to supply or influence an untrusted Bake definition that performs a multi-target build. Under certain conditions, paths from some targets can avoid verification against the filesystem read entitlements that were approved.
Are default filesystem-read approvals sufficient protection?
No. In affected multi-target builds, some filesystem paths may not be checked against the expected fs.read approval, allowing access to client-accessible files beyond the approved entitlement scope.
What should be done if updating is not immediately possible?
Avoid running untrusted Bake definitions, particularly definitions that build multiple targets together. Restrict Buildx client access to sensitive files until the issue can be remediated.
Which Buildx versions need remediation?
Docker Buildx versions v0.19.0 through v0.38.0 are affected. The issue is fixed in v0.38.1.