github.com/chainguard-dev/kaniko
Go2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/chainguard-dev/kanikopage 1 of 1
- CVE-2026-105769CRITICALCVSS 9.3EG 9.3fixed in 1.25.202026-11-02
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-crede…
- CVE-2026-28406HIGHCVSS 8.2EG 8.2fixed in 1.25.102026-02-27
kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)`…
Check whether github.com/chainguard-dev/kaniko is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/chainguard-dev/kaniko CVEs against the assets you own.
Book a Demo →