Incorrect authorization in Buildx - CVE-2026-121541
Published: November 9, 2026
Vulnerability identifier: #VU162947
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121541
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unprivileged local attacker to expose files accessible to the Buildx client without the user's expected filesystem read approval.
The vulnerability exists due to incomplete filesystem entitlement verification in Buildx Bake when multiple targets are built together. An unprivileged local attacker can supply an untrusted Bake definition that a user runs to access paths not covered by approved fs.read entitlements.
Affected software
Buildx
How to mitigate CVE-2026-121541
Install security update from vendor's website.
Buildx - update to 0.38.1