CVE-2026-103433

Executive Summary

CVE-2026-103433 is a missing authorization vulnerability (CWE-862) in Docker Buildx Bake, where the tool fails to request the expected fs.read approval for certain filesystem inputs. This allows an untrusted Bake definition to expose readable files through a pathless secret (interpreting the secret ID as a client-side pathname) or to consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions—such as those from untrusted repositories or CI/CD pipelines—are affected, potentially leading to unauthorized file disclosure or unintended local resource consumption.

Technical Analysis

The vulnerability resides in the entitlement validation logic of Docker Buildx Bake. Normally, operations that read from the filesystem (e.g., accessing secrets or local OCI layouts) require an explicit fs.read entitlement approval from the user. CVE-2026-103433 describes two distinct bypass mechanisms:

1. Pathless secret exposure: A Bake definition can define a secret without an explicit file path. In this case, the secret's ID field is treated as a client-side pathname. Because the entitlement check does not correctly validate this interpretation, the Buildx client may read and expose the contents of a file identified by the secret ID—without requesting the expected fs.read approval.
2. OCI layout consumption outside project: An attacker can craft a Bake definition that references a local OCI image layout located outside the project directory. The entitlement validation checks a different path representation (e.g., a resolved absolute path versus a relative path), allowing the build to consume an OCI layout that should have been blocked.

Both issues stem from a missing authorization check (CWE-862): the system fails to verify that the user has granted the fs.read entitlement for the intended operation. The attack surface is the Bake definition file, which is often sourced from untrusted repositories, container registries, or shared CI/CD configurations. There is no known public exploit code or PoC, and no patch is currently available.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class (missing authorization).

1. Reconnaissance/Target Identification: An attacker identifies a target that uses Docker Buildx Bake to build images from untrusted sources (e.g., a CI/CD pipeline that pulls Bake definitions from a public repository or a user who runs a shared Bake file). The attacker does not need direct access to the target system; they only need to supply a malicious Bake definition.
2. Triggering the Flaw: The attacker crafts a Bake definition that includes either:
   • A secret entry with a pathless definition where the ID is set to a sensitive file path on the client (e.g., /etc/passwd or a credentials file). When the victim runs docker buildx bake, the tool interprets the secret ID as a pathname and reads the file without requesting fs.read approval.
   • A reference to a local OCI image layout outside the project directory, exploiting the mismatch in path representation during entitlement validation.
3. Payload/Execution Method: The malicious Bake definition is delivered via a repository, a shared build configuration, or a CI/CD pipeline. No code execution is required on the attacker's part; the victim's own build process performs the unauthorized read. The exposed file content may be embedded into the built image, printed in logs, or exfiltrated through subsequent build steps.
4. Post-Exploitation Impact: Successful exploitation leads to unauthorized disclosure of readable files on the client system (e.g., SSH keys, cloud credentials, source code) or unintended consumption of local OCI images that may contain sensitive data. The attacker can use this information for lateral movement, privilege escalation, or further compromise of the build environment.

Impact Assessment

The vulnerability allows an attacker to bypass entitlement validation and read files that should have been protected by the fs.read permission. This can result in the exposure of sensitive data such as API keys, tokens, or configuration files present on the client machine running the build. Additionally, the ability to consume local OCI image layouts outside the project could leak proprietary image contents or enable further supply chain attacks. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates a network attack vector, low attack complexity, no privileges required, and user interaction required (the victim must run the malicious Bake definition). The confidentiality impact is high, while integrity and availability impacts are none. The blast radius is limited to the build environment, but if the build environment has access to production secrets or sensitive data, the impact can be significant.

Detection Guidance

Sigma Rule

title: Docker Buildx Bake Unauthorized fs.read via Pathless Secret
id: 3f8a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects execution of docker buildx bake with a Bake definition that may attempt to bypass fs.read entitlement checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103433
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/docker'
    CommandLine|contains|all:
      - 'buildx'
      - 'bake'
  condition: selection
falsepositives:
  - Legitimate buildx bake usage
level: medium

YARA Rule

rule CVE_2026_103433_Bake_Entitlement_Bypass
{
    meta:
        description = "Detects Bake definition files attempting to bypass fs.read entitlement via pathless secrets or OCI layout references"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103433"
        date = "2026-01-01"
    strings:
        $s1 = "secret" ascii wide nocase
        $s2 = "fs.read" ascii wide nocase
        $s3 = "oci" ascii wide nocase
        $s4 = "layout" ascii wide nocase
        $s5 = "id=" ascii wide nocase
    condition:
        uint32(0) == 0x7B2C0A0D or // typical JSON start? not reliable. Use file size and strings.
        (2 of ($s1, $s2, $s3, $s4, $s5))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103433 Docker Buildx Bake Entitlement Bypass Attempt"; flow:to_server,established; content:"buildx"; http_header; content:"bake"; http_header; content:"secret"; http_header; content:"fs.read"; http_header; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic Detection

process where process.name == "docker" and process.args : ("buildx", "bake") and process.args : ("secret", "fs.read")

Splunk SPL Query

index=main sourcetype=process_creation
| search (process_name="docker" OR process_name="docker.exe") AND process_command_line="*buildx*bake*"
| rex field=process_command_line "(?<bake_file>\S+\.hcl|\S+\.json|\S+\.yaml)"
| table _time, host, user, process_command_line, bake_file

Wazuh OSSEC Rule

<group name="docker,">
  <rule id="100001" level="8">
    <decoded>json</decoded>
    <field name="command">docker</field>
    <field name="args">buildx bake</field>
    <description>CVE-2026-103433: Docker Buildx Bake execution detected - potential entitlement bypass</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Avoid running untrusted Bake definitions. Only use Bake files from trusted sources.
   • Review Bake definitions for pathless secrets (secrets without an explicit file attribute) and for references to OCI layouts outside the project directory.
   • Restrict the Docker daemon's access to sensitive host files by running builds in isolated environments (e.g., containers with limited filesystem access).
   • Monitor build logs for unexpected file contents or access to sensitive paths.

2. Patch/Upgrade Steps:

   • No official patch is currently available. Monitor the Docker Buildx repository and Docker security advisories for updates.
   • Once a patch is released, upgrade to the fixed version immediately.

3. Long-term Hardening:

   • Implement strict entitlement policies and consider disabling fs.read entitlements unless absolutely necessary.
   • Use separate, low-privilege service accounts for CI/CD builds to limit the impact of file disclosure.
   • Regularly audit Bake definitions and their sources.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103433
• Docker Buildx GitHub: https://github.com/docker/buildx
• Docker Security Advisories: https://docs.docker.com/security/
• CWE-862: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1552: https://attack.mitre.org/techniques/T1552/