Threats tagged 'ghsa-5q7h-w9jf-cx97'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Critical	9.3	CVE-2026-105769github.com/chainguard-dev/kaniko · kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts Critical9.32026-11-05GCVE DatabaseCVE-2026-105769 kaniko versions before 1.25.20 contain a vulnerability in the Azure Container Registry (ACR) credential helper that can cause it to send Microsoft Entra ID (Azure AD) access tokens to attacker-controlled lookalike registry hosts. This occurs when a Dockerfile references images from a hostname containing '.azurecr.io' or similar domains, allowing an attacker to receive live Azure Resource Manager tokens. The vulnerability is fixed in kaniko v1.25.20 by tightening hostname validation in the credential helper. Report on CVE-2026-105769 Vulnerability CWE-346 #ghsa-5q7h-w9jf-cx97 #go	GCVE Database	2026-11-05

Page 1 of 1