{"id":"CVE-2026-103433","aliases":["BELL-CVE-2026-103433","DEBIAN-CVE-2026-103433","EUVD-2026-92818","GHSA-p54p-jq4x-rc28","UBUNTU-CVE-2026-103433"],"status":"published","title":"Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions","description":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00288,"percentile":0.21586,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-10-05T21:54:44Z","modified":"2026-11-11T07:30:06Z","fixes":[{"ecosystem":"Alpaquita:25","package":"docker-cli-buildx","fixed_in":["0.24.0-r19"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"docker-cli-buildx","fixed_in":["0.37.2-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"docker-cli-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-r0"},{"fixed":"0.24.0-r19"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker-cli-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0-r0"},{"fixed":"0.37.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.1+ds1-3","0.19.3+ds1-1","0.19.3+ds1-2","0.19.3+ds1-3","0.19.3+ds1-4","0.29.1+ds1-1","0.29.1+ds1-2","0.29.1+ds1-3","0.29.1+ds1-4"]},{"source":"osv","ecosystem":"Debian:14","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.1+ds1-3","0.19.3+ds1-1","0.19.3+ds1-2","0.19.3+ds1-3","0.19.3+ds1-4","0.29.1+ds1-1","0.29.1+ds1-2","0.29.1+ds1-3","0.29.1+ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-0ubuntu1~20.04.1","0.11.2-0ubuntu1~20.04.2","0.12.1-0ubuntu1~20.04.1","0.12.1-0ubuntu1~20.04.2","0.14.1-0ubuntu1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-0ubuntu1~22.04.1","0.11.2-0ubuntu1~22.04.2","0.12.1-0ubuntu1~22.04.1","0.12.1-0ubuntu1~22.04.2","0.14.1-0ubuntu1~22.04.1","0.20.1-0ubuntu1~22.04.1","0.20.1-0ubuntu1~22.04.2","0.21.3-0ubuntu1~22.04.1","0.30.1-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-0ubuntu2","0.12.1-0ubuntu1","0.12.1-0ubuntu2","0.12.1-0ubuntu2.1","0.12.1-0ubuntu2.2","0.14.1-0ubuntu1~24.04.1","0.20.1-0ubuntu1~24.04.1","0.20.1-0ubuntu1~24.04.2","0.21.3-0ubuntu1~24.04.1","0.30.1-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.1-0ubuntu1","0.36.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.3-0ubuntu1","0.30.1-0ubuntu1"]}],"products":[{"vendor":"docker","product":"docker buildx"}],"references":[{"url":"https://github.com/docker/buildx/security/advisories/GHSA-p54p-jq4x-rc28","tags":["vendor-advisory","advisory","report"]},{"url":"https://github.com/docker/buildx/releases/tag/v0.37.2","tags":["patch","fix","report"]},{"url":"https://github.com/docker/buildx","tags":["product","package","report"]},{"url":"https://docs.docker.com/build/bake/reference/#targetentitlements","tags":["technical-description","article","report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-103433","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103433.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103433","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-103433","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-103433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103433","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-103433","title":"Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions","description":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.","status":"published","published":"2026-10-05T21:54:44.822Z","modified":"2026-10-06T13:36:00.334Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-92818","description":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.","status":"published","published":"2026-10-05T21:54:44Z","modified":"2026-10-06T13:36:00Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:37.923108Z"}],"nvd":[{"id":"CVE-2026-103433","description":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.","status":"published","published":"2026-10-05T22:16:56.37Z","modified":"2026-10-06T15:08:38.397Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:54.129949Z"}],"osv":[{"id":"CVE-2026-103433","title":"Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions","description":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.","status":"published","published":"2026-10-05T21:54:44.822Z","modified":"2026-10-28T02:30:23.444850481Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"DEBIAN-CVE-2026-103433","description":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.","status":"published","published":"2026-10-05T22:16:56.37Z","modified":"2026-10-07T09:47:34.473274297Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"UBUNTU-CVE-2026-103433","description":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.","status":"published","published":"2026-10-05T22:16:00Z","modified":"2026-10-17T12:57:59.036228115Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"BELL-CVE-2026-103433","status":"published","published":"2026-10-09T06:09:29.677189Z","modified":"2026-11-11T07:30:06.467516337Z","updated_at":"2026-11-11T07:56:32.232974Z"}]}}