logo_clicknbuy.png

CVE-2025-0495 – Buildx OpenTelemetry Cache Secrets Exfiltration

The following table lists the changes that have been made to the
CVE-2025-0495 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Mar. 17, 2025

    Action Type Old Value New Value
    Added Description Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.

    Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon’s history records.

    This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.
    Added CVSS V4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-532
    Added Reference https://github.com/docker/buildx
Share the Post:

Related Posts