Incorrect authorization in Buildx - CVE-2026-121542
Published: November 9, 2026
Vulnerability identifier: #VU162946
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121542
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker supplying an untrusted Bake definition to expose files accessible to a victim's Buildx client without filesystem read approval.
The vulnerability exists due to an incorrect path entitlement check in Buildx Bake for sibling paths whose names start with the current working directory's basename. An attacker supplying an untrusted Bake definition can reference matching paths outside the project directory when those paths exist and the victim runs the definition.
Affected software
Buildx
How to mitigate CVE-2026-121542
Install security update from vendor's website.
Buildx - update to 0.38.1