CVE-2026-105769 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

kaniko before 1.25.20 can send a Microsoft Entra ID Azure AD access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR regist...