Missing Authorization in Buildx - CVE-2026-103433
Published: November 9, 2026
Vulnerability identifier: #VU162945
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-103433
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker controlling an untrusted Bake definition to expose files accessible to the Buildx client without the user's filesystem-read approval.
The vulnerability exists due to skipped fs.read entitlement consent checks in Buildx Bake for pathless build secrets and build contexts sourced from local OCI layouts. An attacker controlling an untrusted Bake definition can supply either affected definition and expose client-accessible files when a user runs it.
Affected software
Buildx
How to mitigate CVE-2026-103433
Install security update from vendor's website.
Buildx - update to 0.37.2