CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, terragrunt-fips, gitea, external-secrets-operator, grype-db, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips, kubevela-fips, mapotf,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, terragrunt-fips, gitea, external-secrets-operator, grype-db, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips, kubevela-fips, mapotf,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, terragrunt-fips, gitea, external-secrets-operator, grype-db, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips, kubevela-fips, mapotf,...

SUSE CVE-2026-28406

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

GO-2026-4580 kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko

kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko...

kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories

kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A tar entry like ../outside.txt escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this ca...

GHSA-6RXQ-Q92G-4RMF kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories

kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A tar entry like ../outside.txt escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this ca...

CVE-2026-28406

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

CVE-2026-28406

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

CVE-2026-28406

CVE-2026-28406 affects kaniko up to 1.25.10. During tar extraction, build context archives were unpacked with filepath.Join(dest, cleanedName) without ensuring the final path stays inside dest, allowing a tar entry like ../outside.txt to escape the extraction root and write files outside the dest...

CVE-2026-28406 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

CVE-2026-28406 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

CVE-2026-28406 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

EUVD-2026-9077

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

PT-2026-22407

Name of the Vulnerable Software and Affected Versions kaniko versions 1.25.4 through 1.25.9 Description kaniko is a tool used to build container images from a Dockerfile within a container or Kubernetes cluster. Versions from 1.25.4 up to, but not including, 1.25.10 improperly handle the extracti...

kaniko 路径遍历漏洞

Kaniko is a tool developed by Chainguard Forks for building container images in Kubernetes. Versions of Kaniko prior to 1.25.10 contained a path traversal vulnerability. This vulnerability stemmed from the lack of ensuring that the final path was within the target directory during the decompressi...

CLEANSTART-2026-GJ12884 Within HostnameError

Multiple security vulnerabilities affect the kaniko-fips package. Within HostnameError. See references for individual vulnerability details...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: beats-fips, spegel, step-issuer, aws-network-policy-agent, wavefront-collector-for-kubernetes, openfga, xeol, mc, aws-load-balancer-controller, dapr-fips, nvidia-container-toolkit, rclone, conjur-cli, kubewatch, nfs-subdir-external-provisioner, http-echo,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: spegel, step-issuer, aws-network-policy-agent, wavefront-collector-for-kubernetes, rclone, rancher-webhook, crane, kubewatch, nfs-subdir-external-provisioner, actions-runner-controller-fips, http-echo, kafkaexporter, restic, nri-elasticsearch, fq, ko, monstache,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: helm-push, kaniko, docker-cli-buildx, k3s, opa-envoy, docker, trivy, ctop, neuvector-scanner, helm-operator, kubevela, grype, wolfictl, cilium-cli, docker-compose, flux-source-controller, k8ssandra-client, zarf, helm, cert-manager-cmctl, chartmuseum, zot,...