Skip to content
OpenAdvisories

Package · Go

github.com/chainguard-dev/kaniko

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-105769

    kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

    kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which…

    Chainguard kaniko github.com/chainguard-dev/kaniko Go