Docker Buildx CVE-2026-121541

Exploitation requires the victim to run an untrusted Bake definition that builds multiple targets together (a single-target build does not exhibit the issue per the advisory); under unspecified 'certain conditions' the filesystem paths from some of those targets are not verified against the approved fs.read entitlements, exposing files accessible to the Buildx client. Limiting factors: the vector is local (AV:L), the victim must actively initiate the build of the attacker-controlled definition (UI:A), the condition is attacker-uncontrolled/intermittent (AT:P - 'sometimes'/'certain conditions'), and only Buildx versions v0.19.0 through v0.38.0 are affected (v0.38.1+ is fixed). Impact is limited to reading files already accessible to the Buildx client. The precise trigger mechanism is not described in the available sources.

This is a medium-severity authorization (entitlement) bypass, consistent with its CVSS 4.0 score of 5.6. The vector tells a restrained story: AV:L means the flaw is reached locally through the Buildx client rather than over a network, AT:P flags that exploitation depends on an attacker-uncontrolled condition (the advisory says paths escape entitlement checks only 'under certain conditions' / 'sometimes' in multi-target builds), and UI:A requires the victim to actively run the build. PR:N indicates no prior privileges are needed, but that is gated by the far stronger practical precondition that the victim must choose to run an untrusted Bake definition. Impact is confidentiality-only (VC:H, VI:N, VA:N): unauthorized read of files accessible to the Buildx client, not code execution or tampering. On exploitation signals: the input shows no CISA KEV listing, no EPSS probability, and no PoC - the sole reference is the Docker GHSA advisory itself, not exploit code. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the picture of a genuine but conditional, interaction-dependent, confidentiality-only issue rather than a widely-weaponized flaw. Net: a real issue worth patching on a normal cadence, not a drop-everything emergency, and its priority is bounded by the requirement to run untrusted build definitions. Missing data to note: EPSS is absent, so widespread-exploitation probability cannot be quantified; the precise trigger condition ('certain conditions') is not described in the advisory.

An attacker publishes a repository or supplies a Bake definition that builds multiple targets together and references filesystem paths outside the directories the victim intends to grant. When the victim runs the untrusted Bake definition, the fs.read entitlement approval is skipped for some targets under certain conditions, allowing files readable by the Buildx client to be exposed to the build without the expected approval prompt. No public exploit code is identified at the time of analysis; the only reference is the vendor advisory.