ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Customize Public modeDiscuss ChangeIntel on Discord
CVE-2025-0495

Secrets leakage to telemetry endpoint via cache backend configuration via buildx

CVSS 4.0 4.1 MEDIUMEUVD CVSS 4.0 4.1 CVSS 4.0 · [email protected] · Secondary 4.1 MEDIUMCVSS_V4 Publisher rating MODERATEFixed by github.com/docker/buildx 0.21.3osv · severity unknownFixed by github.com/docker/buildx 0.21.3KEV status unknown
Original advisory

cve-program · CVE-2025-0495

Published

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.

Read the publisher's advisory

euvd · EUVD-2025-6497

Published

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.

Read the publisher's advisory

nvd · CVE-2025-0495

Published

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.

Read the publisher's advisory

osv · GHSA-m4gq-fm9h-8q75

Published

### Impact Some cache backends allow configuring their credentials by setting secrets directly as attribute values in `cache-to/cache-from` configuration. If this was done by the user, these secure values could be captured together with OpenTelemetry trace as part of the arguments and flags for the traced CLI command. Passing tokens to Github cache backend via environment variables or using registry authentication is not affected. If you passed a token value like this and use a custom OpenTelemetry collector for computing traces you should make sure that your traces are kept secure. OpenTelemetry traces are also saved in BuildKit daemon's history records. ### Patches Issue has been fixed in Buildx v0.21.3 or newer. ### Workarounds Avoid passing cache backend credentials with CLI arguments. Make sure access to traces and BuildKit history records is kept secure.

Read the publisher's advisory

osv · GO-2025-3527

Published

buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2025-0495

Published

buildx

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "buildx",
                    "product": "buildx",
                    "repo": "https://github.com/docker/buildx",
                    "vendor": "docker",
                    "versions": [
                        {
                            "lessThanOrEqual": "0.21.2",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-6497

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 17, 2025, 7:21:11 PM

dateUpdated: Mar 18, 2025, 4:25:42 PM

15 related source bulletins · separate from aliases

SUSE-SU-2026:22546-1: Security update for docker-compose

CVE-2025-0495 · CVE-2025-22869 · CVE-2026-33814 · CVE-2026-39821

openSUSE-SU-2025:14910-1: govulncheck-vulndb-0.0.20250318T181448-1.1 on GA media

CVE-2024-40635 · CVE-2025-0495 · CVE-2025-2241 · CVE-2025-29781 · CVE-2025-29786

SUSE-SU-2026:22703-1: Security update for docker-compose

CVE-2025-0495 · CVE-2025-22869 · CVE-2026-33814 · CVE-2026-39821

openSUSE-SU-2025:14985-1: docker-27.5.1_ce-15.1 on GA media

CVE-2025-0495 · CVE-2025-22868 · CVE-2025-22869

openSUSE-SU-2025:14980-1: docker-stable-24.0.9_ce-9.1 on GA media

CVE-2025-0495

SUSE-SU-2025:02289-2: Security update for docker

CVE-2025-0495 · CVE-2025-22872

SUSE-SU-2025:20360-1: Security update for docker

CVE-2025-0495 · CVE-2025-22868 · CVE-2025-22869

SUSE-SU-2025:1341-1: Security update for docker

CVE-2025-0495

SUSE-SU-2026:22887-1: Security update for docker-compose

CVE-2025-0495 · CVE-2025-22869 · CVE-2026-33814 · CVE-2026-39821

SUSE-SU-2025:1344-1: Security update for docker-stable

CVE-2025-0495

openSUSE-SU-2026:21247-1: Security update for docker-compose

CVE-2025-0495 · CVE-2025-22869 · CVE-2026-33814 · CVE-2026-39821

msrc_CVE-2025-0495: Secrets leakage to telemetry endpoint via cache backend configuration via buildx

CVE-2025-0495

SUSE-SU-2025:20205-1: Security update for docker

CVE-2024-29018 · CVE-2025-0495 · CVE-2025-22868 · CVE-2025-22869

SUSE-SU-2026:22567-1: Security update for docker-compose

CVE-2025-0495 · CVE-2025-22869 · CVE-2026-33814 · CVE-2026-39821

SUSE-SU-2025:02289-1: Security update for docker

CVE-2025-0495 · CVE-2025-22872

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-0495

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-532

Original publisher date fields

published: 2025-03-17T20:15:13.737

lastModified: 2026-06-17T08:26:35.910

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-m4gq-fm9h-8q75

Published

github.com/docker/buildx

Go

SEMVER · introduced 0 → fixed 0.21.3

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2025-3527

Published

github.com/docker/buildx

Go

SEMVER · introduced 0 → fixed 0.21.3

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 18:02 UTC · 254 of 275 readable · 250 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.