CVE-2025-0495: docker buildx
Vulnerability summary
CVE-2025-0495 is a medium (CVSS 4.1) vulnerability in docker buildx. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 14Timeline
- 17-03-2025PublishedVulnerability first disclosed.
- 18-03-2025Last modifiedVulnerability information updated.
Description
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated4.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated4.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated4.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated4.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated4.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
- NVDNIST4.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard3 products
- docker-compose< 2.34.0-r1
- docker-compose-fips< 2.34.0-r2
- kubescape< 3.0.43-r0
Suse2 products
- docker-stable&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 24.0.9_ce-1.14.1
- docker&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 27.5.1_ce-98.129.1
Wolfi2 products
- docker-compose< 2.34.0-r1
- kubescape< 3.0.43-r0
Debian1 product
- docker-buildx< 0.13.1+ds1-3
Docker1 product
- buildx≤ 0.21.2
Github.com/docker1 product
- buildx< 0.21.3
Opensuse1 product
- docker-stable&distro=openSUSE Tumbleweed< 24.0.9_ce-9.1
Ubuntu1 product
- docker-buildxAll versions (No fix recorded)
8 vendors · 12 products
