Skip to content

Chainguard-forks Kaniko vulnerabilities

chainguard kanikokaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostsCVE-2026-105769Fix available9.3 CriticalNovember 2, 2026
chainguard kaniko, red hat openshift serverless +1 morekaniko has tar archive path traversal in build context extraction allows writing files outside destination directoryCVE-2026-28406Fix available8.2 HighFebruary 27, 2026