CVE-2026-28406 - Vulnerability Analysis

Overview

kaniko >= 1.25.4 and < 1.25.10 contains a path traversal caused by improper path sanitization in build context archive extraction, letting attackers execute code within the executor process, exploit requires registry authentication.

Severity & Score

Impact

Attackers can execute code within the executor process, potentially compromising the build environment.

Mitigation

Update to version 1.25.10 or later.

References

• https://github.com/chainguard-forks/kaniko/commit/a370e4b1f66e6e842b685c8f70ed507964c4b221
• https://github.com/chainguard-forks/kaniko/pull/326
• https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-6rxq-q92g-4rmf

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🟠 CVE-2026-28406 - High (8.2) kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28406/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner