Docker Buildx OpenTelemetry Trace Vulnerability Exposing Secrets

A vulnerability exists in Docker Buildx, a CLI plugin that enhances Docker's build capabilities, by allowing sensitive information to be unintentionally recorded in OpenTelemetry traces. This issue arises when cache backend support credentials are provided as secrets in the cache-to/cache-from configuration, which can then be captured along with the CLI command arguments and flags in the OpenTelemetry traces. These traces are also stored in the BuildKit daemon's history records. Notably, this vulnerability does not affect secrets sent to the GitHub cache backend via environment variables or registry authentication.

Impact

The vulnerability could lead to the exposure of sensitive information, as secure values can be captured in OpenTelemetry traces and saved in the BuildKit daemon's history records.