CVE-2026-103433

— UNSCOREDpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/docker/buildx
https://github.com/docker/buildx/releases/tag/v0.37.2
https://github.com/docker/buildx/security/advisories/GHSA-p54p-jq4x-rc28

All references

https://docs.docker.com/build/bake/reference/#targetentitlements
https://github.com/docker/buildx
https://github.com/docker/buildx/releases/tag/v0.37.2
https://github.com/docker/buildx/security/advisories/GHSA-p54p-jq4x-rc28

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
HIGHCVE-2025-71433PoC
MEDIUMCVE-2026-0198
HIGHCVE-2026-100217
CRITICALCVE-2026-100240
HIGHCVE-2026-100266

Related by shared AI tags and CWE weakness class. Browse the full archive.