Vulnerability GO-2026-6902
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:55 PM UTC
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko
<1.25.20
<1.25.20
Summary
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko
Details
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
14 hours ago
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
<1.25.20 GHSA-5q7h-w9jf-cx97
<1.25.20 GHSA-5q7h-w9jf-cx97
Unknown
8 months ago
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko
>=1.25.4 <1.25.10 GO-2026-4580
>=1.25.4 <1.25.10 GO-2026-4580
High Risk
8 months ago
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories
>=1.25.4 <1.25.10 GHSA-6rxq-q92g-4rmf
>=1.25.4 <1.25.10 GHSA-6rxq-q92g-4rmf
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:55 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC