GO-2026-6902: kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko

Q: Which builds should be investigated for possible credential exposure?

Investigate kaniko builds that used Azure (Entra ID) authentication and interacted with registry hosts that could be lookalikes of Azure Container Registry hosts. The exposed credential is the build's Azure access token.

Q: What does an attacker need to trigger the issue?

The issue involves a lookalike ACR registry host receiving the build's Azure (Entra ID) access token. The available information does not specify additional prerequisites or whether default configurations are affected.

Published Nov 5, 2026

Updated

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko

Affected Software

1 affected componentFixes available

go/github.com/chainguard-dev/kaniko<1.25.20

1.25.20

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/chainguard-dev/kaniko to a version that resolves this vulnerability.
Fixed in 1.25.20

Event History

Nov 5, 2026

Advisory Published

via OSV·10:55 PM

Data Sourced

via OSV·10:55 PM

DescriptionAffected Software

Frequently Asked Questions

Which builds should be investigated for possible credential exposure?

Investigate kaniko builds that used Azure (Entra ID) authentication and interacted with registry hosts that could be lookalikes of Azure Container Registry hosts. The exposed credential is the build's Azure access token.

What does an attacker need to trigger the issue?

The issue involves a lookalike ACR registry host receiving the build's Azure (Entra ID) access token. The available information does not specify additional prerequisites or whether default configurations are affected.

GO-2026-6902: kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko

Affected Software

Remediation

Event History

Frequently Asked Questions

Which builds should be investigated for possible credential exposure?

What does an attacker need to trigger the issue?

Company

Resources

Contact

Frequently Asked Questions

Which builds should be investigated for possible credential exposure?

What does an attacker need to trigger the issue?