Go/github.com/chainguard-dev/kaniko CVE-2026-28406: unknown, EPSS 0.85%
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko
Action: Upgrade github.com/chainguard-dev/kaniko to 1.25.10 or later.
go get github.com/chainguard-dev/kaniko@v1.25.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.25.4 | 1.25.10 | - |
Fixed versions
| 1.25.10 |
Sources
- osv: GO-2026-4580
- https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-6rxq-q92g-4rmf
- https://nvd.nist.gov/vuln/detail/CVE-2026-28406
- https://github.com/chainguard-forks/kaniko/commit/a370e4b1f66e6e842b685c8f70ed507964c4b221
- https://github.com/chainguard-forks/kaniko/pull/326
- https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.10
CVE-2026-28406 · published · modified · JSON