kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

chainguard kaniko

kaniko before v1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to a registry host an attacker controls. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img, is enough. The build needs no RUN instruction and never has to push.

Do this now

Check kaniko's advisory for a fix and restrict builds to trusted base image hosts meanwhile.

Who should check: teams running Go

First seen: 5 Nov 2026
Last update: 5 Nov 2026, 18:17 UTC
Versions per GitHub advisory, not the vendor: github.com/chainguard-dev/kaniko 1.25.20
Identifiers: CVE-2026-105769
CVSS: 9.3
Source: GitHub advisory
On the menu as: Go

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Severity: critical. Patch status: fix status unknown.
Affected: chainguard kaniko
Versions per GitHub advisory, not the vendor: github.com/chainguard-dev/kaniko 1.25.20
Ids: CVE-2026-105769

kaniko before v1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to a registry host an attacker controls. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img, is enough. The build needs no RUN instruction and never has to push.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `github.com/chainguard-dev/kaniko`. For each hit, compare the installed version with the version on the same major line (per GitHub advisory, not the vendor, so check the vendor's advisory before treating it as a fix): github.com/chainguard-dev/kaniko 1.25.20. If it's lower, give the exact upgrade command for the package manager this repo uses.
2. Versions per GitHub advisory, not the vendor: github.com/chainguard-dev/kaniko: older than 1.25.20 → 1.25.20. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| github.com/chainguard-dev/kaniko older than 1.25.20 | per GitHub advisory, not the vendor | 1.25.20 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-105769") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-5q7h-w9jf-cx97 https://github.com/chainguard-forks/kaniko/pull/495 https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97 https://github.com/chrismellard/docker-credential-acr-env/issues/21 https://nvd.nist.gov/vuln/detail/CVE-2026-105769
https://pwned.coffee/i/kaniko-can-send-the-build-s-azure-entra-id-access-token-cve-2026-105769

Timeline

5 Nov 2026, 18:17 UTC
Fix status: patched → unknown.
5 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
By release line, per GitHub advisory, not the vendor: Product Affected Version named Source
github.com/chainguard-dev/kaniko (go) < 1.25.20 1.25.20 GitHub advisory per GitHub advisory, not the vendor checked 5 Nov
Score: CVSS 9.3 (critical). CVSS 3.1 9.3 (CNA chainguard) for CVE-2026-105769
Last checked: 6 Nov 2026, 12:18 UTC

Product	Affected	Version named	Source
github.com/chainguard-dev/kaniko (go)	< 1.25.20	1.25.20	GitHub advisory per GitHub advisory, not the vendor checked 5 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee