Skip to content
OpenAdvisories

Package · Go

github.com/chainguard-dev/kaniko

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.3
    CVE-2026-105769

    kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

    kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which…

    Chainguard kaniko github.com/chainguard-dev/kaniko Go
  • High 8.2
    CVE-2026-28406

    kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

    kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing t…

    chainguard-forks kaniko github.com/chainguard-dev/kaniko Go