Log in Start free

Vulnerability · Published Feb 27, 2026 · Assigned by GitHub_M

CVE-2026-28406kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

High 8.2

In plain English

A high-severity path traversal in kaniko from chainguard-forks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.7%top 47.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path stays within `dest`. A tar entry like `../outside.txt` escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Version 1.25.10 uses securejoin for path resolution in tar extraction.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/chainguard-dev/kaniko1.25.10GHSA-6rxq-q92g-4rmf
Gogithub.com/chainguard-dev/kaniko1.25.10GO-2026-4580

Affected products (as reported)

VendorProductVersions
chainguard-forks kaniko >= 1.25.4, < 1.25.10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References