CVE-2026-103433

Published: October 9, 2026Last modified: October 9, 2026

Description

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.

Status

Product	Release	Package	Status
Alpaquita Linux	25 LTS	docker-cli-buildx	Vulnerable (0.24.0-r0)
Alpaquita Linux	Stream	docker-cli-buildx	Fixed (0.37.2-r0)

References

How to Fix Liberica NIK Not Starting on macOS Catalina and Later

If you use macOS Catalina and later you may encounter the issue that prevents Liberica NIK from starting. To fix it, run the following:

sudo xattr -r -d com.apple.quarantine path/to/graalvm/folder/

If you need more help, check out the FAQ at the bottom of this page or contact us.