Docker Buildx CVE-2026-121542

Exploitation requires the victim to actively run an UNTRUSTED Bake definition in Docker Buildx (v0.19.0-v0.38.0); it is not remotely reachable and only triggers through this user action (UI:A). The specific prerequisite from the advisory: a target path must use the current working directory's basename as a prefix and reside under the same parent directory as the working directory, AND a file with a specifically matching filename must exist next to the current project directory. Limiting factors: only confidentiality is affected and only at Low (unauthorized read of client-accessible files, not write or execution); the attacker cannot choose arbitrary paths, only ones satisfying the basename-prefix/matching-filename pattern; and users who build only trusted Bake definitions are not affected. The vendor's stated workaround is to run only trusted Bake definitions and inspect them for suspicious paths outside trusted directories until upgrading to v0.38.1+.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The vendor (Docker) CVSS 4.0 vector scores it 1.8 (Low) with AV:L (local), AT:P (a specific attack requirement must hold), UI:A (active user participation), and only VC:L confidentiality impact with no integrity or availability impact - meaning the worst outcome is limited unauthorized file read, not code execution or data tampering. The vuln.today decision label is 'monitor', the weakest urgency tier, consistent with the low score. There is no CISA KEV listing and no EPSS score supplied; no public exploit identified at time of analysis. The only reference is the vendor's own GHSA advisory. The realistic risk is confined to users who deliberately build untrusted Bake definitions AND who happen to have sensitive files whose names match the current project directory's basename as a prefix in the parent directory - a narrow, somewhat contrived precondition. Note one nuance to verify: although PR:N marks it 'unauthenticated,' exploitation is not remote - it depends entirely on the victim locally invoking an attacker-supplied Bake definition (UI:A), so treat 'unauthenticated' as 'no credentials needed' rather than 'remotely reachable.' No EPSS, KEV, or POC data was provided to contradict the low vendor assessment.

An attacker publishes or sends a malicious Bake definition (e.g., in a repository a developer clones and builds). When the victim runs the untrusted definition with Buildx, a path crafted to use the current working directory's basename as a prefix under the same parent directory bypasses the fs.read entitlement prompt, letting the definition read a neighboring file the client should have been asked to approve. No public exploit code is identified; exploitation requires the victim to actively run the attacker's definition and depends on specific matching filenames existing next to the project directory.