Skip to content
Chainguard vulnerabilities
Newest
-
chainguard minio
MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.
CVE-2026-122267
8.8 High
-
chainguard kaniko
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
CVE-2026-105769
Fix available
9.3 Critical
-
chainguard academy (edu)
Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands
CVE-2026-105767
2.1 Low
-
chainguard academy (edu)
Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP
CVE-2026-105766
2.3 Low
-
chainguard melange
melange has Path Traversal via .PKGINFO in --persist-lint-results
CVE-2026-29051
Fix available
4.4 Medium
-
chainguard melange
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
CVE-2026-29050
Fix available
6.1 Medium
-
chainguard melange
melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI
CVE-2026-29049
Fix available
4.3 Medium
-
chainguard malcontent
malcontent's nested archive extraction failure can drop content from scan inputs
CVE-2026-28407
Fix available
6.9 Medium
-
chainguard kaniko, red hat openshift serverless +1 more
kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory
CVE-2026-28406
Fix available
8.2 High
-
chainguard melange
melange has a path traversal in license-path which allows reading files outside workspace
CVE-2026-25145
Fix available
5.5 Medium
-
chainguard melange
melange affected by potential host command execution via license-check YAML mode patch pipeline
CVE-2026-25143
Fix available
7.8 High
-
chainguard apko
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
CVE-2026-25140
Fix available
7.5 High
-
chainguard apko
apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
CVE-2026-25122
Fix available
5.5 Medium
-
chainguard apko
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
CVE-2026-25121
Fix available
7.5 High
-
chainguard melange
melange pipeline working-directory could allow command injection
CVE-2026-24844
Fix available
7.8 High
-
chainguard melange
melange QEMU runner could write files outside workspace directory
CVE-2026-24843
Fix available
8.2 High
-
chainguard malcontent
malcontent's archive extraction could write outside extraction directory
CVE-2026-24846
Fix available
5.5 Medium
-
chainguard malcontent
malcontent's OCI image scanning could expose registry credentials
CVE-2026-24845
Fix available
6.5 Medium