Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Fix availableCritical · CVSS 9.3EPSS 0.20%

Published Nov 5, 2026 · updated Nov 5, 2026

What to do

  1. Upgrade to a fixed version: github.com/chainguard-dev/kaniko 1.25.20.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/chainguard-dev/kaniko

Vulnerable versions
< 1.25.20
Fixed in
1.25.20

Check your project: go list -m all | grep github.com/chainguard-dev/kaniko

What changed

  1. Nov 5, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-346 Origin Validation Error · CWE-522 Insufficiently Protected Credentials

← All critical vulnerabilities