Sensitive Data Exposure in Docker Buildx Due to OpenTelemetry Tracing
Summary
DEBIAN-CVE-2025-0495: Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Affects docker-buildx versions < 0.13.1+ds1-3. Fixed in 0.13.1+ds1-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker Buildx is a powerful CLI plugin for Docker that enhances build capabilities by leveraging BuildKit. It allows users to create and manage multi-platform images and provides advanced caching mechanisms. However, its integration with OpenTelemetry for tracing can inadvertently expose sensitive data when user input is mishandled.
Vulnerability Detail
The vulnerability arises from the way Docker Buildx handles cache backends that support credentials. When these credentials are supplied as user input, they can be captured in OpenTelemetry traces, which are logged as part of the command's arguments and flags. This exposure can lead to unauthorized access to sensitive information, as traces are also stored in the BuildKit daemon's history records. Importantly, this issue does not affect secrets passed to the Github cache backend via environment variables or registry authentication.
How To Fix
Minimum fixed version
0.13.1+ds1-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker-buildxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user input for sensitive credentials in cache-to/cache-from configurations. Instead, utilize environment variables for passing secrets, which will not be captured in OpenTelemetry traces.
Conclusion
The vulnerability in Docker Buildx highlights the importance of secure handling of sensitive data, especially in tracing mechanisms. Users are encouraged to update to the latest version to mitigate risks and ensure the security of their applications.
See every vulnerability recorded for docker-buildx →
FAQ
The vulnerability allows sensitive credentials to be captured in OpenTelemetry traces due to improper handling of user input.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The main risk is unauthorized access to sensitive data, which could lead to security breaches and data leaks.
Yes, the vulnerability is fixed in version 0.13.1+ds1-3 of Docker Buildx.
If an immediate update is not possible, avoid using user input for sensitive credentials and rely on environment variables instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for docker-buildx.
