SB20261109161 - Multiple vulnerabilities in Buildx

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: CVE-2026-121542)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker supplying an untrusted Bake definition to expose files accessible to a victim's Buildx client without filesystem read approval.

The vulnerability exists due to an incorrect path entitlement check in Buildx Bake for sibling paths whose names start with the current working directory's basename. An attacker supplying an untrusted Bake definition can reference matching paths outside the project directory when those paths exist and the victim runs the definition.

2) Incorrect authorization (CVE-ID: CVE-2026-121541)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unprivileged local attacker to expose files accessible to the Buildx client without the user's expected filesystem read approval.

The vulnerability exists due to incomplete filesystem entitlement verification in Buildx Bake when multiple targets are built together. An unprivileged local attacker can supply an untrusted Bake definition that a user runs to access paths not covered by approved fs.read entitlements.

Remediation

Install update from vendor's website.

References

• https://github.com/docker/buildx/security/advisories/GHSA-rghq-x9hf-hc3r
• https://github.com/docker/buildx/security/advisories/GHSA-xg6v-cv2h-2w5h