CVE Watch3 de nov. de 2026

CVE-2026-121541

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files acces

CVSS

—

Sem CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 3 de nov. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-863

EPSS · 30d

0.1%EPSS · 30 dias0.1%

2026-11-042026-11-05

Descrição técnica

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

Referências oficiais

github.comhttps://github.com/docker/buildx/security/advisories/GHSA-xg6v-cv2h-2w5h

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1233343.8 BAI

—

———In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project9h CVE-2026-1233333.8 BAI

—

———In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints9h CVE-2026-1233286.4 MÉD

—

———In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab9h CVE-2026-1233267.1 ALT

—

———In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension9h CVE-2026-1233247.7 ALT

—

———In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible9h CVE-2026-1232993.1 BAI

—

———In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible9h