CVE-2026-103433: Docker Buildx Bake Information Disclosure

CVE-2026-103433 Overview

CVE-2026-103433 is a missing authorization vulnerability [CWE-862] in Docker Buildx Bake. The flaw allows an untrusted Bake definition to bypass the expected fs.read entitlement approval for certain filesystem inputs. Attackers can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname. They can also consume a local Open Container Initiative (OCI) image layout outside the project directory after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected. Docker released a fix in Buildx v0.37.2.

Critical Impact
Untrusted Bake definitions can read arbitrary files on the host outside the project directory, bypassing the entitlement prompt designed to gate filesystem access.

Affected Products

Docker Buildx (Bake command) prior to v0.37.2
Build pipelines consuming third-party docker-bake.hcl, docker-bake.json, or docker-bake.yaml definitions
CI/CD runners executing docker buildx bake against untrusted sources

Discovery Timeline

2026-10-05 - CVE-2026-103433 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103433

Vulnerability Analysis

Docker Buildx Bake orchestrates multi-target builds defined in Bake files. The Bake entitlement model is designed to prompt the user before granting filesystem read access to paths outside the project directory via the fs.read entitlement. This vulnerability breaks that trust boundary in two distinct ways.

First, a pathless secret definition can have its id field interpreted as a client-side filename. The secret reader then opens that file and surfaces its contents through the build context without triggering the expected approval flow. Second, when a target references a local OCI image layout, entitlement validation inspects one path representation while the loader consumes a different representation. This parser inconsistency allows a Bake definition to point at content outside the declared project root.

An attacker who controls a Bake definition can exfiltrate sensitive host files such as SSH keys, cloud credential files, or environment configuration. The user running docker buildx bake sees no entitlement prompt indicating that out-of-tree data was accessed.

Root Cause

The root cause is missing authorization [CWE-862] at the filesystem input layer. The entitlement check and the filesystem consumer disagree on which path is being accessed. Secret IDs are overloaded as pathnames without passing through the fs.read gate, and OCI layout path normalization is inconsistent between validation and consumption.

Attack Vector

Exploitation requires a user to execute docker buildx bake against an attacker-controlled or attacker-modified Bake definition. The attack vector is network-reachable in the sense that malicious Bake files can be delivered through public repositories, pull requests, or supply-chain pipelines. User interaction is required to invoke the build. No prior privilege on the target host is needed beyond the ability to deliver the Bake file.

The vulnerability is described in prose only. Technical details are published in the GitHub Security Advisory GHSA-p54p-jq4x-rc28 and the Docker Bake Reference Guide.

Detection Methods for CVE-2026-103433

Indicators of Compromise

Bake definitions declaring secrets without a src or env field but with an id resembling an absolute path such as /home/user/.ssh/id_rsa or /root/.aws/credentials.
Bake targets referencing OCI image layouts with path components containing .., symlinks, or encoded separators that resolve outside the project directory.
Build logs showing filesystem reads from locations outside the repository checkout without a preceding entitlement prompt.

Detection Strategies

Statically scan docker-bake.hcl, docker-bake.json, and docker-bake.yaml files in source control for pathless secret definitions and suspicious OCI layout references.
Audit CI/CD job output for docker buildx bake invocations against untrusted branches or forks and correlate with filesystem access telemetry on build runners.
Compare the installed Buildx version on build hosts against v0.37.2 using docker buildx version.

Monitoring Recommendations

Monitor build runners for process reads targeting credential stores, SSH keys, and cloud configuration directories by buildx or buildkitd processes.
Alert on outbound network transfers of large build contexts from CI runners handling untrusted pull requests.
Track Buildx version drift across build infrastructure and flag any node still on a pre-v0.37.2 release.

How to Mitigate CVE-2026-103433

Immediate Actions Required

Upgrade Docker Buildx to v0.37.2 or later on all build hosts, developer workstations, and CI/CD runners.
Do not run docker buildx bake against Bake definitions from untrusted sources, including unvetted pull requests from external contributors.
Review existing Bake files in your repositories for pathless secret declarations and malformed OCI layout references.

Patch Information

Docker released Buildx v0.37.2 containing the fix. The patch enforces the fs.read entitlement for secret IDs that resolve to filesystem paths and normalizes OCI layout path handling so that validation and consumption agree on the target path. Full details are available in GitHub Security Advisory GHSA-p54p-jq4x-rc28.

Workarounds

Execute docker buildx bake only against Bake definitions authored or reviewed by trusted maintainers until the upgrade is complete.
Run builds inside ephemeral, isolated containers or sandboxed CI runners with no access to host credentials, SSH keys, or cloud metadata.
Explicitly set the --allow flag only for required entitlements and reject builds that request unexpected filesystem access.

bash

# Upgrade Docker Buildx to the patched release
docker buildx version

# Install Buildx v0.37.2 as a Docker CLI plugin
mkdir -p ~/.docker/cli-plugins
curl -SL \
  https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-amd64 \
  -o ~/.docker/cli-plugins/docker-buildx
chmod +x ~/.docker/cli-plugins/docker-buildx

# Verify the installed version
docker buildx version