Key points
- Docker released an update to fix CVE-2026-93325 in Buildx.
- The flaw allows remote code execution in the context of the current user.
- Exploitation requires a user to open a malicious file or visit a bad page.
Docker has issued a security update for its Buildx tool to address a high-severity vulnerability rated 7.8 by the Zero Day Initiative. The flaw, tracked as CVE-2026-93325, allows attackers to run arbitrary code on affected systems. This follows a pattern of urgent patches, similar to the SolusVM root execution fix Patch Herald reported on 2026-10-15, requiring immediate attention from administrators managing container builds.
In plain English
The vulnerability exists in how Docker Buildx processes bake definition files. These files define how containers are built. The system failed to apply a necessary protection mechanism when handling these inputs. An attacker can craft a malicious bake file that, when processed, executes code. This code runs with the same permissions as the user who triggered the build process. It does not grant root access, but it does allow full control over the user's session.
The background
The Zero Day Initiative reported this vulnerability to Docker on 2026-07-29. The advisory was released publicly on 2026-10-15. The flaw allows remote code execution, but it is not fully automatic. A target must interact with the malicious content. Specifically, the user must visit a webpage controlled by an attacker or open a file sent by an attacker. This interaction requirement limits the ease of exploitation compared to unauthenticated network attacks, such as the Windows QUIC flaws Patch Herald covered on 2026-10-13.
What changes now
Docker has provided an update to correct this vulnerability. The official advisory links to a GitHub security advisory for further technical details. Users of Docker Buildx should apply this update as soon as possible. The patch addresses the failure to apply a protection mechanism in bake definition file processing. Until the update is installed, any bake file processed by the tool could potentially trigger the flaw if it contains malicious instructions crafted by an attacker.
Who needs to act first
Teams managing container builds should prioritize updating Docker Buildx on systems exposed to external inputs. Check whether bake files are sourced from untrusted origins or shared across teams. Roll out the fix to development environments first to ensure compatibility with existing workflows. Back up current build configurations before applying the update. If immediate patching is not possible, restrict access to build tools and avoid opening bake files from unknown sources. Monitor logs for unusual execution patterns after updates.
What to do and how to stay safe
- Update Docker Buildx to the latest version provided by the vendor.
- Verify that all bake definition files come from trusted sources.
- Train users to avoid opening unexpected build configuration files.
- Monitor system logs for unauthorized code execution attempts.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The Zero Day Initiative assigned a CVSS rating of 7.8.
Does this flaw require user interaction to exploit?
Yes, the target must visit a malicious page or open a malicious file.
