CVE-2025-0495

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-0495
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0495.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-0495
Aliases
Downstream
Related
Published
2025-03-17T19:21:11.295Z
Modified
2026-07-23T18:29:46.988628123Z
Severity
  • 4.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
Secrets leakage to telemetry endpoint via cache backend configuration via buildx
Details

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.

Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.

This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.

Database specific 
{
    "cwe_ids": [
        "CWE-532"
    ],
    "cna_assigner": "Docker",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0495.json"
}
References

Affected packages

Git / github.com/docker/buildx

Affected ranges

Type
GIT
Repo
https://github.com/docker/buildx
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1360a9e8d25a2c3d03c2776d53ae62e6ff0a843d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.21.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.10.0-rc1
v0.10.0-rc2
v0.11.0
v0.11.0-rc1
v0.11.0-rc2
v0.12.0-rc1
v0.12.0-rc2
v0.13.0-rc1
v0.13.0-rc2
v0.14.0
v0.14.0-rc1
v0.14.0-rc2
v0.15.0
v0.15.0-rc1
v0.15.0-rc2
v0.16.0-rc1
v0.16.0-rc2
v0.17.0-rc1
v0.17.0-rc2
v0.18.0-rc1
v0.18.0-rc2
v0.18.0-rc3
v0.19.0
v0.19.0-rc1
v0.19.0-rc2
v0.2.0
v0.2.1
v0.2.2
v0.20.0-rc1
v0.20.0-rc2
v0.20.0-rc3
v0.21.0
v0.21.0-rc1
v0.21.0-rc2
v0.21.0-rc3
v0.21.1
v0.21.2
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.0-rc1
v0.5.1
v0.6.0
v0.6.0-rc1
v0.6.1
v0.7.0
v0.7.0-rc1
v0.8.0
v0.8.0-rc1
v0.9.0
v0.9.0-rc1
v0.9.0-rc2
v0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0495.json"