Description
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.
Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.
This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| docker | buildx | ≤ 0.21.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | docker-buildx | 0.13.1+ds1-3 | — |
| Debian 13 | docker-buildx | 0.13.1+ds1-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | docker-buildx | No fix yet | — |
| Ubuntu 26.04 LTS | docker-buildx | No fix yet | — |
| Ubuntu 25.10 | docker-buildx | No fix yet | — |
| Ubuntu 24.04 LTS | docker-buildx | No fix yet | — |
| Ubuntu 22.04 LTS | docker-buildx | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | docker-buildx | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| SLES 15 SP7 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-1 |
| SLES 15 SP6 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| SLES 15 SP6 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-1 |
| SLES 15 SP5 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLES 15 SP5 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SLES 15 SP4 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLES 15 SP4 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SLES 15 SP3 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLES 15 SP3 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | docker | 27.5.1_ce-98.129.1 | SUSE-SU-2025:1341-1 |
| SLES 12 SP5 | docker-stable | 24.0.9_ce-1.14.1 | SUSE-SU-2025:1344-1 |
| SLES for SAP 16.0 | docker-compose | 2.33.1-160000.5.1 | SUSE-SU-2026:22567-1 |
| SLES for SAP 15 SP5 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLES for SAP 15 SP5 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SLES for SAP 15 SP4 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLES for SAP 15 SP4 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SLES for SAP 15 SP3 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLES for SAP 15 SP3 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SLES 16.0 | docker-compose | 2.33.1-160000.5.1 | SUSE-SU-2026:22567-1 |
| SLE Micro 6.2 | docker-compose | 2.33.1-160000.5.1 | SUSE-SU-2026:22546-1 |
| SLE Micro 6.1 | docker | 27.5.1_ce-slfo.1.1_2.1 | SUSE-SU-2025:20360-1 |
| SLE Micro 6.1 | docker-compose | 2.33.1-slfo.1.1_3.1 | SUSE-SU-2026:22887-1 |
| SLE Micro 6.0 | docker | 27.5.1_ce-2.1 | SUSE-SU-2025:20205-1 |
| SLE Micro 6.0 | docker-compose | 2.33.1-5.1 | SUSE-SU-2026:22703-1 |
| SLE Micro 5.5 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| SLE Micro 5.4 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| SLE Micro 5.3 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| SLE Micro 5.2 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| SLE Micro 5.1 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| SLE HPC 15 SP5 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLE HPC 15 SP5 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SLE HPC 15 SP4 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLE HPC 15 SP4 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SLE HPC 15 SP3 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SLE HPC 15 SP3 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
| SUSE Enterprise Storage 7.1 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-2 |
| SUSE Enterprise Storage 7.1 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | docker | 27.5.1_ce-15.1 | openSUSE-SU-2025:14985-1 |
| openSUSE Tumbleweed | docker-stable | 24.0.9_ce-9.1 | openSUSE-SU-2025:14980-1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250318T181448-1.1 | openSUSE-SU-2025:14910-1 |
| openSUSE Leap 16.0 | docker-compose | 2.33.1-160000.5.1 | openSUSE-SU-2026:21247-1 |
| openSUSE Leap 15.6 | docker | 28.2.2_ce-150000.227.1 | SUSE-SU-2025:02289-1 |
| openSUSE Leap 15.6 | docker-stable | 24.0.9_ce-150000.1.22.1 | SUSE-SU-2025:02289-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | docker-buildx | 0.14.0-5 | — |
| Azure Linux 2 (CBL-Mariner) | moby-buildx | 0.7.1-25 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | docker-compose | 2.34.0-r1 | — |
| Wolfi rolling | kubescape | 3.0.43-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/docker/buildx | < 0.21.3 | 0.21.3 | GHSA-m4gq-fm9h-8q75 |
Advisories 14
- SUSE-SU-2026:22887-1 Security update for docker-compose SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22703-1 Security update for docker-compose SUSE / openSUSE Security Updates · Jul 23, 2026
- SUSE-SU-2026:22567-1 Security update for docker-compose SUSE / openSUSE Security Updates · Jul 15, 2026
- SUSE-SU-2026:22546-1 Security update for docker-compose SUSE / openSUSE Security Updates · Jul 14, 2026
- openSUSE-SU-2026:21247-1 Security update for docker-compose SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2025:20360-1 Security update for docker SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20205-1 Security update for docker SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02289-2 Security update for docker SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:14980-1 docker-stable-24.0.9_ce-9.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14985-1 docker-27.5.1_ce-15.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02289-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1344-1 Security update for docker-stable SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1341-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14910-1 govulncheck-vulndb-0.0.20250318T181448-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026