CVE-2026-121542: 
Docker vulnerability analysis and mitigation

CVE-2026-121542 is a filesystem path entitlement bypass vulnerability in Docker Buildx that allows an untrusted Bake definition to expose files accessible to the Buildx client without the expected fs.read approval. It affects Docker Buildx versions v0.19.0 through v0.38.0 and was disclosed on November 3, 2026. The issue is fixed in v0.38.1. It carries a CVSS v4.0 base score of 1.8 (Low) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). When Docker Buildx evaluates a Bake definition, it performs a filesystem entitlement check (fs.read) to restrict access to files outside the project directory. However, paths located under the same parent directory as the current working directory whose names share the working directory's basename as a prefix can bypass this check — for example, if the working directory is /projects/myapp, a sibling directory named /projects/myapp-secrets could be inadvertently accessible. Exploitation requires an attacker to supply a crafted, untrusted Bake definition and that specific matching filenames exist adjacent to the current project directory (GitHub Advisory).

Successful exploitation results in unauthorized read access to files on the Buildx client's filesystem that should be protected by the fs.read entitlement check. The confidentiality impact is limited (low), with no integrity or availability impact. Sensitive files adjacent to the project directory — such as configuration files, credentials, or secrets — could be exposed to an attacker who controls the Bake definition (GitHub Advisory, Feedly).

There are no known public proof-of-concept exploits or reports of in-the-wild exploitation for this vulnerability. The EPSS score is approximately 0.145%, indicating a low probability of exploitation in the near term. The attack vector is local, requires active user interaction (running an untrusted Bake definition), and depends on specific filesystem conditions (matching filenames adjacent to the working directory), all of which significantly limit exploitability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

1. Prepare a malicious Bake definition: Craft a docker-bake.hcl or equivalent Bake definition file that references paths outside the intended project directory, specifically targeting sibling directories whose names share the current working directory's basename as a prefix (e.g., if the project is myapp, target myapp-config or myapp-secrets).
2. Social-engineer the victim: Convince a developer or CI/CD pipeline operator to run docker buildx bake using the malicious Bake definition file, either by hosting it in a repository or supplying it directly.
3. Trigger the entitlement bypass: When the victim executes docker buildx bake -f malicious-bake.hcl, the Buildx client processes the definition and, due to the prefix-matching flaw, skips the fs.read entitlement check for the targeted sibling paths.
4. Exfiltrate files: The build context or build output includes the contents of files from the bypassed paths, which the attacker can retrieve from the resulting image layers or build artifacts (GitHub Advisory).

• File System: Unexpected files from sibling directories (sharing the working directory's basename as a prefix) appearing in Docker build contexts or image layers.
• Logs: Docker Buildx logs showing file access to paths outside the expected project directory during a bake operation; absence of fs.read entitlement denial logs for paths that should have been blocked.
• Process: Execution of docker buildx bake with externally sourced or unreviewed Bake definition files, particularly from untrusted repositories or third parties.

Upgrade Docker Buildx to v0.38.1 or later, which contains the fix for this vulnerability. As a workaround prior to upgrading, only run trusted Bake definitions and review any Bake definitions for suspicious paths referencing directories outside the project root. Additionally, verify that no sibling directories with names prefixed by the current working directory's basename contain sensitive files (GitHub Advisory).

The vulnerability was reported to Docker by the hCaptcha Security Team and was published as a low-severity advisory by Docker maintainer tonistiigi on November 3, 2026. No significant broader media coverage or notable community discussion has been identified beyond the official advisory (GitHub Advisory).