kaniko में बिल्ड कॉन्टेक्स्ट एक्सट्रैक्शन में टार आर्काइव पाथ ट्रावर्सल है, जिससे github.com/chainguard-dev/kaniko में गंतव्य निर्देशिकाओं के बाहर फ़ाइलें लिखने की अनुमति मिलती है

The core of this vulnerability lies in Kaniko's handling of the build context. An attacker can craft a malicious build context that includes specially crafted filenames, leveraging path traversal sequences (e.g., ../) to escape the intended build directory. This allows them to write arbitrary files to locations on the host system where Kaniko is running, potentially overwriting critical system files or injecting malicious code into the image. The impact can range from denial of service (by overwriting essential files) to complete system compromise if the attacker gains write access to sensitive areas. This vulnerability is particularly concerning in CI/CD pipelines where Kaniko is used to automate image builds, as it could allow attackers to inject malicious code into production images.

Organizations heavily reliant on Kaniko for automated container image builds, particularly those using it within CI/CD pipelines, are at significant risk. Shared hosting environments where multiple users build images using a shared Kaniko instance are also vulnerable, as a malicious build from one user could potentially impact other users' images or the host system itself. Legacy Kaniko deployments using older versions are particularly susceptible.

• go / kaniko: Inspect build scripts and Dockerfiles for unusual file paths or references to external directories. Use go vet to scan Kaniko source code for potential path traversal vulnerabilities. • linux / server: Monitor build logs for unexpected file creation or modification in sensitive directories. Use auditd to track file access events within the Kaniko build environment.

auditctl -w /path/to/kaniko/build/directory -p wa -k kaniko_build

• generic web: If Kaniko is integrated into a web application, monitor access logs for requests containing suspicious path traversal sequences in the build context parameters.

grep '..\/' /var/log/nginx/access.log

1. 2026-03-10Disclosure

   disclosure

1. आरक्षित2026-02-27
2. प्रकाशित2026-03-10
3. संशोधित2026-03-23
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-28406 is to upgrade to Kaniko version 1.25.10 or later. If an immediate upgrade is not feasible due to compatibility issues, consider implementing stricter build context validation. This could involve whitelisting allowed files and directories within the build context, preventing the inclusion of potentially malicious files. Additionally, running Kaniko in a sandboxed environment with limited file system access can reduce the potential impact of a successful exploit. Monitor build processes for unexpected file modifications and consider implementing a WAF or proxy to inspect build requests for suspicious path traversal patterns. After upgrading, confirm the fix by attempting a build with a malicious context containing path traversal sequences; the build should fail with an appropriate error.