CVE-2026-121541
Description
A flaw was found in Docker Buildx. When building multiple targets simultaneously using an untrusted Bake definition, filesystem paths from certain targets fail to be verified against approved access entitlements. An attacker could exploit this flaw by enticing a user to execute a malicious build definition, resulting in unauthorized information disclosure of local files accessible to the client without required read permissions.
Statement
This vulnerability is rated as Moderate severity for Red Hat products because successful exploitation requires user interaction to process an untrusted build configuration, limiting the attack scope to environments evaluating unverified Bake definitions. In typical Red Hat deployments, build workflows rely on trusted and managed project specifications, preventing unprivileged or external actors from triggering the missing entitlement check. Furthermore, the issue only compromises confidentiality of files accessible to the invoking user's local context, without granting code execution or write access to the underlying system.
Mitigation
Run only trusted Bake definitions and upgrade Docker Buildx to v0.38.1 or later. For rhceph/alloy-rhel10, exposure is limited to the vendored buildx v0.23.0 library; the container neither ships the Buildx client nor invokes Bake multi-target builds.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Files or Directories; Modify Files or Directories
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
