// Microsoft AzureCRITICAL
CVE-2026-105769 is a critical vulnerability (CVSS 9.3) in kaniko before version 1.25.20 that allows attackers to exfiltrate Microsoft Entra ID (Azure AD) access tokens for Azure Resource Manager. The flaw stems from an unanchored regex in the Azure Container Registry credential helper that accepts any hostname containing .azurecr.io or related domains; a malicious Dockerfile referencing a lookalike registry (e.g., FROM x.azurecr.io.attacker.com) causes the helper to post credentials to the attacker's endpoint. No public exploitation has been reported. Patched version 1.25.20 is available.
// Get alerts for Microsoft Azure