CVE-2026-28406: Path Traversal in Kaniko

The core of this vulnerability lies in Kaniko's handling of the build context. An attacker can craft a malicious build context that includes specially crafted filenames, leveraging path traversal sequences (e.g., ../) to escape the intended build directory. This allows them to write arbitrary files to locations on the host system where Kaniko is running, potentially overwriting critical system files or injecting malicious code into the image. The impact can range from denial of service (by overwriting essential files) to complete system compromise if the attacker gains write access to sensitive areas. This vulnerability is particularly concerning in CI/CD pipelines where Kaniko is used to automate image builds, as it could allow attackers to inject malicious code into production images.

1. Reserved2026-02-27
2. Published2026-03-10
3. Modified2026-03-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-28406 is to upgrade to Kaniko version 1.25.10 or later. If an immediate upgrade is not feasible due to compatibility issues, consider implementing stricter build context validation. This could involve whitelisting allowed files and directories within the build context, preventing the inclusion of potentially malicious files. Additionally, running Kaniko in a sandboxed environment with limited file system access can reduce the potential impact of a successful exploit. Monitor build processes for unexpected file modifications and consider implementing a WAF or proxy to inspect build requests for suspicious path traversal patterns. After upgrading, confirm the fix by attempting a build with a malicious context containing path traversal sequences; the build should fail with an appropriate error.