Docker Buildx CVE-2026-103433

Exploitation requires the victim to run an untrusted docker-buildx Bake definition supplied by the attacker (UI:A) - this is the explicit prerequisite stated in the advisory ('Users who run untrusted Bake definitions are affected'). The specific triggers are: (1) a pathless secret whose ID Buildx interprets as a client-side pathname, causing a readable file to be exposed without the expected fs.read approval; or (2) a local OCI image layout referenced outside the project, where entitlement validation checks a different path representation than the one actually consumed. Limiting factors: environments that only build their own trusted, first-party Bake definitions are not exposed; there is no remote-unauthenticated path against a default build of trusted content, and impact is read-only (no code execution, write, or availability loss).

This is a genuine but moderate-priority issue, best characterized as an information-disclosure/entitlement-bypass flaw rather than a critical remote threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H with VI:N/VA:N) correctly reflects a confidentiality-only impact gated by required user interaction: a victim must actively choose to run an attacker-supplied ('untrusted') Bake definition, which is the single biggest limiting factor. No EPSS score, KEV listing, or POC was provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - exploitation probability signals are simply absent, not low. There is no conflict between the CVSS vector and the description: both agree exploitation is user-interaction-dependent (the untrusted definition must be executed) and yields file/layout read exposure only, with no integrity or availability impact and no privilege gain. The score of 6.9 is driven almost entirely by VC:H; the practical risk is bounded by the fact that an operator must already be running definitions from an untrusted source (e.g. a cloned repository or supplied CI config). Net: real and worth patching (fix exists), but not an emergency for environments that only build trusted, first-party Bake definitions.

An attacker publishes a repository (or supplies a CI pipeline) containing a malicious docker-buildx Bake definition. When a developer or CI runner executes docker buildx bake against it, the definition uses a pathless secret whose ID is interpreted as a client-side pathname - or references a local OCI image layout outside the project - to read a file the build was never entitled to access and expose its contents into the build. No public exploit code was identified at time of analysis, and success requires the victim to actively run the untrusted definition (UI:A).