CVE-2026-103433: Docker Buildx

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.

Affected products

• Docker Docker Buildx: before 0.37.2 (fixed in 0.37.2)

Published 2026-10-05. Last modified 2026-10-06.