Most recent entries from all

bdu:2025-06572

2026-10-02T13:40:09.835469+00:00

bdu:2025-06572

BELL-CVE-2025-0495

2026-10-02T13:40:09.835503+00:00

Affected: Alpaquita:stream: docker-cli-buildx

EUVD-2026-223352

2026-10-02T13:40:09.835529+00:00

EUVD-2026-223352

fkie_cve-2025-0495

2026-10-02T13:40:09.835541+00:00

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.

Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.

This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.

GHSA-m4gq-fm9h-8q75 — buildx allows a possible credential leakage to telemetry endpoint

2026-10-02T13:40:09.835570+00:00

Affected: Go: github.com/docker/buildx

### Impact Some cache backends allow configuring their credentials by setting secrets directly as attribute values in `cache-to/cache-from` configuration. If this was done by the user, these secure values could be captured together with OpenTelemetry trace as part of the arguments and flags for the traced CLI command. Passing tokens to Github cache backend via environment variables or using registry authentication is not affected.

If you passed a token value like this and use a custom OpenTelemetry collector for computing traces you should make sure that your traces are kept secure. OpenTelemetry traces are also saved in BuildKit daemon's history records.

### Patches Issue has been fixed in Buildx v0.21.3 or newer.

### Workarounds Avoid passing cache backend credentials with CLI arguments. Make sure access to traces and BuildKit history records is kept secure.

msrc_CVE-2025-0495 — Secrets leakage to telemetry endpoint via cache backend configuration via buildx

2026-10-02T13:40:09.835598+00:00

msrc_CVE-2025-0495

openSUSE-SU-2025:14910-1 — govulncheck-vulndb-0.0.20250318T181448-1.1 on GA media

2026-10-02T13:40:09.835614+00:00

govulncheck-vulndb-0.0.20250318T181448-1.1 on GA media

SUSE-SU-2025:1341-1 — Security update for docker

2026-10-02T13:40:09.835631+00:00

Security update for docker

UBUNTU-CVE-2025-0495

2026-10-02T13:40:09.835644+00:00

Affected: Ubuntu:20.04:LTS: docker-buildx, Ubuntu:22.04:LTS: docker-buildx, Ubuntu:24.04:LTS: docker-buildx, Ubuntu:25.10: docker-buildx, Ubuntu:26.04:LTS: docker-buildx

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.