kaniko hat eine Pfadüberschreitung in der Tar-Archiv-Extraktion des Build-Kontexts, wodurch Dateischreibvorgänge außerhalb der Zielverzeichnisse in github.com/chainguard-dev/kaniko möglich sind.

The Path Traversal vulnerability in Kaniko allows an attacker to manipulate the build process to write arbitrary files on the host system. This is achieved by crafting a malicious Dockerfile that exploits the flaw in Kaniko's context extraction logic. Successful exploitation could lead to unauthorized code execution, data exfiltration, or even complete system takeover. The blast radius extends to any system where Kaniko is used to build container images, particularly in CI/CD pipelines or automated build environments. This vulnerability shares similarities with other path traversal exploits where attackers leverage insufficient input validation to access or modify files outside of their intended scope.

Organizations heavily reliant on Kaniko for automated container image builds, particularly those using it within CI/CD pipelines, are at significant risk. Shared hosting environments where multiple users build images using a shared Kaniko instance are also vulnerable, as a malicious build from one user could potentially impact other users' images or the host system itself. Legacy Kaniko deployments using older versions are particularly susceptible.

• go / kaniko: Inspect build scripts and Dockerfiles for unusual file paths or references to external directories. Use go vet to scan Kaniko source code for potential path traversal vulnerabilities. • linux / server: Monitor build logs for unexpected file creation or modification in sensitive directories. Use auditd to track file access events within the Kaniko build environment.

auditctl -w /path/to/kaniko/build/directory -p wa -k kaniko_build

• generic web: If Kaniko is integrated into a web application, monitor access logs for requests containing suspicious path traversal sequences in the build context parameters.

grep '..\/' /var/log/nginx/access.log

1. 2026-03-10Disclosure

   disclosure

1. Reserviert2026-02-27
2. Veröffentlicht2026-03-10
3. Geändert2026-03-23
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-28406 is to upgrade to Kaniko version 1.25.10 or later, which includes a fix for the vulnerability. If upgrading immediately is not feasible, consider implementing stricter build context validation within your CI/CD pipelines to limit the potential impact. Employing a Web Application Firewall (WAF) or reverse proxy with appropriate rules to filter out malicious file paths in the build context can provide an additional layer of defense. Carefully review and sanitize any user-provided input used in Dockerfiles to prevent attackers from injecting malicious commands.