Docker Buildx: multi-target Bake builds can read client-side files without the expected fs.read approval

Impact

When Buildx runs a Bake definition that builds several targets together, filesystem paths from some targets are not checked against the approved entitlements, so the build can read files the Buildx client can reach without the operator granting fs.read for them. For a GPU shop this is a build-pipeline trust issue: if container images for the fleet are built from definitions that come from untrusted or semi-trusted sources (contributor PRs, tenant-supplied build recipes, shared CI runners), a crafted Bake file can pull in local files such as credentials, kubeconfigs or registry tokens from the build host and bake them into an image or build output. The flaw is in the client-side entitlement check, not in the runtime, so it does not by itself give code execution on GPU nodes; the risk is credential and source disclosure from whatever host runs the build.

Who can reach it

Someone who can supply the Bake definition that an operator or CI job builds. Requires no credentials of their own, but does require the victim to run the untrusted definition - exposure is limited to files already readable by the Buildx client's user.

What to do

Upgrade the Buildx client/CLI plugin to v0.38.1 or later wherever builds run - developer machines, CI runners, build nodes (versions v0.19.0 through v0.38.0 are affected). This is a binary/plugin swap with no node drain or reboot; running builds just need to finish or be re-run. Until upgraded, build untrusted Bake definitions only in a throwaway runner that holds no credentials.

References

Related entries

• BuildKit: NTFS junctions inside the cache root escape the cache mount on Windows container workersCVE-2026-15788 · BuildKitMedium
• containerd: CRI checkpoint import does not validate image references in checkpoint metadataCVE-2026-50195 · containerdMedium
• Kubernetes (kubelet): Pod writes to its own /etc/hosts unaccounted for in evictionCVE-2020-8557 · Kubernetes (kubelet)Medium
• Calico: Route hijacking via the floating IP featureCVE-2022-28224 · CalicoMedium
• containerd: Unbounded memory consumption in containerd daemon via repeated ExecSyncCVE-2022-31030 · containerdMedium
• cosign / sigstore: Multiple verify-blob flaws cause successful verification of unsigned or wrongly-signed artifactsCVE-2022-36056 · cosign / sigstoreMedium