CVE-2026-121541: 
Docker vulnerability analysis and mitigation

CVE-2026-121541 is an incorrect authorization vulnerability in Docker Buildx that allows untrusted Bake definitions to bypass filesystem entitlement checks during multi-target builds. Affected versions span v0.19.0 through v0.38.0; the issue is fixed in v0.38.1. The vulnerability was published on November 3, 2026, and was reported by the hCaptcha Security Team. It carries a CVSS v4.0 base score of 5.6 (Medium) (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization). When Docker Buildx executes a Bake definition that builds multiple targets simultaneously, filesystem path entitlement verification is not consistently applied across all targets — some targets' paths may bypass the required fs.read approval check. This means a maliciously crafted Bake definition can reference filesystem paths outside of approved directories without triggering the expected entitlement gate. The attack vector is local and requires active user interaction (the user must run the untrusted Bake definition), with attack requirements present (multi-target build context) (GitHub Advisory).

Successful exploitation allows an attacker-controlled Bake definition to read files accessible to the Buildx client that should be protected by fs.read entitlement approval, resulting in a high confidentiality impact. There is no integrity or availability impact. The primary risk is exfiltration of sensitive files from the build environment — such as secrets, credentials, or source code — that the build process has access to but should not be exposed to untrusted build definitions (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.112%, indicating a low probability of exploitation in the near term. Exploitation requires a user to voluntarily run an untrusted Bake definition, limiting the attack surface to scenarios where developers or CI/CD pipelines consume externally sourced build configurations (GitHub Advisory).

1. Craft a malicious Bake definition: Create a docker-bake.hcl or docker-bake.json file that defines multiple build targets, where at least one target references filesystem paths outside of trusted/approved directories (e.g., /etc/passwd, SSH keys, or CI secret files).
2. Distribute the definition: Deliver the malicious Bake file to a victim — for example, via a compromised upstream repository, a pull request to a CI/CD pipeline, or a shared build configuration.
3. Trigger a multi-target build: Induce the victim to run docker buildx bake with the malicious definition, building multiple targets simultaneously. The entitlement bypass only manifests in multi-target build scenarios.
4. Bypass entitlement check: Due to the authorization flaw, filesystem paths in some targets are not verified against approved entitlements, allowing the build to read files that should require explicit fs.read approval.
5. Exfiltrate sensitive data: The build process reads and potentially exposes the targeted sensitive files (e.g., embedding them in a build artifact, sending them to a remote registry, or including them in build output accessible to the attacker) (GitHub Advisory).

• File System: Unexpected access to sensitive files (e.g., /etc/passwd, ~/.ssh/, environment variable files, or CI secret mounts) during a docker buildx bake invocation.
• Logs: Docker Buildx build logs showing file reads from paths outside of the project's working directory or declared build context during multi-target bake operations.
• Process: docker buildx bake processes accessing filesystem paths not explicitly declared in trusted build contexts; unexpected file inclusions in resulting container image layers.
• Network: Outbound connections from the build environment to unexpected external endpoints shortly after a multi-target bake run, potentially indicating data exfiltration via a malicious build step.

Upgrade Docker Buildx to v0.38.1 or later, which contains the fix for this vulnerability. As an interim workaround, only run Bake definitions from trusted sources and manually inspect any Bake definition for suspicious filesystem paths outside of expected project directories before executing. CI/CD pipelines that consume externally sourced Bake definitions should be reviewed and restricted to verified configurations (GitHub Advisory).

The vulnerability was reported to Docker by the hCaptcha Security Team and disclosed via GitHub Security Advisories. No significant public commentary, media coverage, or social media discussion has been identified beyond the initial advisory publication (GitHub Advisory).