Exposed Azure Tokens in Kaniko - Chainguard Forks
CVE-2026-105769

9.3CRITICAL

Key Information:

Vendor

Chainguard

Status
Kaniko
Vendor
CVE Published:
2 November 2026

What is CVE-2026-105769?

A vulnerability in Kaniko versions before 1.25.20 permits the exposure of Microsoft Entra ID access tokens due to inadequate validation of registry hosts. The vulnerability arises when Kaniko uses the Azure Container Registry credential helper, allowing any hostname that contains certain Azure-related suffixes to be misidentified as a legitimate registry. This misidentification can lead to an attacker utilizing a crafted Dockerfile to exploit the vulnerability, allowing them to obtain tokens linked to the Azure identity being used. The compromised tokens can be exploited to access Azure Resource Manager with the associated permissions until they expire. This issue has been remedied in version 1.25.20.

Affected Version(s)

kaniko 0 < 1.25.20

References

https://github.com/chainguard-forks/kaniko/security/advis...
vendor-advisory
https://github.com/chainguard-forks/kaniko/pull/495
patch
https://github.com/chainguard-forks/kaniko/releases/tag/v...
release-notes

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Martin Zihlmann (mzihlmann) of osscontainertools
8none1
sergiodj
.