Docker Buildx CVE-2026-93325

Exploitation requires the build to be run with the non-default --progress=rawjson flag - under any other progress mode the consent gate still runs, so default interactive usage is not affected. It further requires the victim to process an untrusted bake definition that references paths outside the working directory. Affected versions are Buildx >=0.21.0, where the rawjson branch first skipped the consent prompt; a later change only re-gated local-output-delete, leaving the rest skipped until v0.37.2. Limiting factors: local access to run buildx (AV:L), the victim must actively invoke the build (UI), no attacker privileges are needed (PR:N), and the specific rawjson mode plus a malicious definition must both be present. The only complete fix stated by the vendor is upgrading to v0.37.2; the vendor workaround is to not run bake with --progress=rawjson on untrusted definitions.

This is a protection-mechanism bypass (CWE-693) in Docker Buildx bake, scored CVSS 4.0 7.3 (High). The signals point to a real but non-emergency issue. The vector is AV:L, so there is no remote network exploitation - an attacker cannot reach this over the wire; the victim must run buildx locally. AT:P and UI:P indicate the attack depends on the victim invoking bake with the non-default --progress=rawjson flag against an attacker-supplied bake definition, which materially limits mass or automated exploitation. Impact is high on confidentiality and integrity (VC:H/VI:H) with low availability impact, consistent with a build escaping the working directory to read or write files it should not. The vuln is NOT in CISA KEV, so exploitation status is: no public exploit identified at time of analysis - the ZDI reference (ZDI-CAN-31688) is a coordinated-disclosure advisory candidate, not verified working exploit code. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be assessed. The vendor decision label is this_week (not act_now/emergency), aligning with a targeted, consent-bypass risk rather than widespread opportunistic attack. One data conflict must be flagged: the GHSA advisory and release tag confirm a fix in v0.37.2, while the package-ecosystem metadata states 'not yet patched' - the advisory/release evidence is authoritative, but the discrepancy should be reconciled before relying on automated version data.

An attacker publishes a repository containing a malicious bake definition that references paths outside the working directory. A developer or CI job clones it and runs docker buildx bake --progress=rawjson; because the rawjson progress mode skips the entitlement consent gate, the build silently reaches outside the working directory to read sensitive files (e.g., credentials or keys) or write to unintended locations. No verified public exploit code exists; only a ZDI coordinated-disclosure advisory is referenced.