Skip to content
OpenAdvisories

Package · Debian

docker-buildx

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.6
    CVE-2026-121541

    Bake filesystem path entitlements approval can be skipped in some multi-target builds

    In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some …

    Docker Docker Buildx docker.io docker.io-app Debian Ubuntu
  • Medium 6.9
    CVE-2026-103433

    Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions

    Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image …

    Docker Docker Buildx docker-buildx docker-buildx Debian Ubuntu
  • Medium 4.1
    CVE-2025-0495

    Secrets leakage to telemetry endpoint via cache backend configuration via buildx

    Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inad…

    Docker buildx docker-buildx docker-buildx Debian Ubuntu Go