CVE-2026-28406: kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory
kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Join(dest, cleanedName) without enforcing that the final path stays within dest. A tar entry like ../outside.txt escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Version 1.25.10 uses securejoin for path resolution in tar extraction.
Other sources
kaniko unpacks build context archives using filepath.Join(dest, cleanedName) without enforcing that the final path stays within dest. A tar entry like ../outside.txt escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Affected versions >= 1.25.4, <= 1.25.9.
Fix: Merged with PR #326 — uses securejoin for path resolution in tar extraction.
Acknowledgements
kaniko thanks Oleh Konko from 1seal for discovering and reporting this issue.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/chainguard-dev/kanikoto a version that resolves this vulnerability.Fixed in 1.25.10 - Upgrade
Upgrade
kanikoto a version that resolves this vulnerability.Fixed in 1.25.10 - Compensating control
If upgrading is not immediately possible, prevent attackers from supplying or influencing build context tar archives/entries (e.g., block/validate build context inputs so tar entries cannot include path traversal like "../outside.txt").
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28406?
CVE-2026-28406 has been classified with a medium severity due to its potential for allowing unauthorized file writes outside designated directories.
How do I fix CVE-2026-28406?
To fix CVE-2026-28406, upgrade kaniko to version 1.25.10 or later, which contains the necessary patches.
Which versions of kaniko are affected by CVE-2026-28406?
kaniko versions between 1.25.4 and 1.25.10 are affected by CVE-2026-28406.
What type of vulnerability is CVE-2026-28406?
CVE-2026-28406 is a path traversal vulnerability found in kaniko during the extraction of build context from tar archives.
Can CVE-2026-28406 be exploited in a Kubernetes environment?
Yes, CVE-2026-28406 can be exploited in a Kubernetes environment where kaniko is used for building container images.