---
title: Tip: rebuild kaniko to 1.25.20+, and never let untrusted Dockerfiles see an Azure identity | ctxsec
url: https://ctxsec.com/items/tip-kaniko-rebuild-1-25-20-or-strip-azure-identity-from-untrusted-builds
description: "CVE-2026-105769 needs only a lookalike FROM line plus an Azure credential in the build environment. Patching without locking down identity still leaves older executors and other ACR helpers exposed."
status: "operational guidance (Chainguard kaniko CVE-2026-105769, Nov 5)"
published: 2026-11-07
---

> CVE-2026-105769 needs only a lookalike FROM line plus an Azure credential in the build environment. Patching without locking down identity still leaves older executors and other ACR helpers exposed.

[← Tips & Guides](/tips) · [markdown](/items/tip-kaniko-rebuild-1-25-20-or-strip-azure-identity-from-untrusted-builds.md)

operational guidance (Chainguard kaniko CVE-2026-105769, Nov 5)

2026-11-07

### Tip: rebuild kaniko to 1.25.20+, and never let untrusted Dockerfiles see an Azure identity

- Pin CI images to kaniko ≥ 1.25.20 and rebuild custom executors/warmers from that tag.
- For untrusted or third-party Dockerfiles: no `AZURE_CLIENT_*` / federated token in the pod, and block IMDS.
- If you already ran untrusted builds with an Azure identity, treat tokens issued in that window as compromised — review Entra sign-in and Azure activity logs; rotating the identity does not revoke issued tokens.

Sources: [GitHub Advisory GHSA-5q7h-w9jf-cx97](https://github.com/advisories/GHSA-5q7h-w9jf-cx97)