{"id":"EM-20261105-0LCS","url":"https://cyber.eventmonitor.net/incident/EM-20261105-0LCS/critical-kaniko-vulnerability-cve-2026-105769/","type":"cve","title":"Critical kaniko Vulnerability (CVE-2026-105769)","subtitle":"CVE-2026-105769","subject":"CVE-2026-105769","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-05T17:48:54.000Z","firstSignal":"2026-11-02T17:17:32.670Z","lastSignal":"2026-11-05T17:48:54.000Z","updated":"2026-11-05T19:02:18.609Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T17:48:54.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-05T17:48:54.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-02T17:17:32.670Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-05T17:48:54.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261105-0LCS created."}],"stages":[{"name":"Disclosed","at":"2026-11-02T17:17:32.670Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-02T17:17:32.670Z","detail":"CVSS 9.3 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-02T17:17:32.670Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-105769 (CVSS 9.3)","text":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. ","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105769"},{"at":"2026-11-05T17:48:54.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":4,"title":"GHSA-5q7h-w9jf-cx97 / CVE-2026-105769: kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts","text":"go:github.com/chainguard-dev/kaniko","url":"https://github.com/advisories/GHSA-5q7h-w9jf-cx97"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-02T17:17:32.670","score":9.3,"severity":"CRITICAL","desc":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registr","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00196,"pct":0.09463,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}