CVE-2026-93325: Docker Buildx Filesystem Entitlements Protection Mechanism Failure Remote Code Execution Vulnerability
Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Docker Buildx. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of bake definition files. The issue results from the failure to apply a protection mechanism. An attacker can leverage this vulnerability to execute code in the context of the current user.
— ZDI
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of affected Docker Buildx installations are exposed when they process a malicious bake definition file or otherwise interact with attacker-supplied content that causes one to be opened. Exploitation runs code in the context of the current user.
What conditions are required for exploitation?
The attacker needs the target to visit a malicious page or open a malicious file, and the vulnerable bake-definition processing must occur with --progress=rawjson. The flaw bypasses the normal entitlement-consent step for access outside the working directory.
Is explicit entitlement approval still required when --progress=rawjson is used?
No. Under --progress=rawjson, the entitlement consent step that would normally require --allow or an interactive prompt is skipped.
What can be done if updating is not immediately possible?
Avoid using --progress=rawjson when processing bake definitions from untrusted sources. Do not open attacker-supplied bake files or follow untrusted pages that may cause such files to be processed.