CVE-2026-28406:

Kaniko container image builder vulnerable to path traversal, allowing potential code execution in certain environments.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.2High

Published Date:Feb 27, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.1
EPSS Percentile:32%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:4.2
Confidentiality Impact:NONE
Integrity Impact:HIGH
Availability Impact:LOW

Description Preview

Kaniko container image builder vulnerable to path traversal, allowing potential code execution in certain environments.

Overview

Kaniko, a tool for building container images from Dockerfiles within containers or Kubernetes clusters, contains a security flaw in versions 1.25.4 to 1.25.9. The vulnerability stems from improper path handling during the extraction of build context archives. By using `filepath.Join(dest, cleanedName)` without enforcing path boundaries, kaniko allows malicious tar entries like `../outside.txt` to write files outside the designated extraction directory. In environments utilizing registry authentication, this vulnerability can be exploited in conjunction with docker credential helpers to achieve code execution within the kaniko executor process. The issue has been assigned a CVSS v3.1 base score of 8.2 (High severity), indicating a significant risk to affected systems.

Remediation

To address this vulnerability, users should upgrade kaniko to version 1.25.10 or later. The patched version implements secure path resolution during tar extraction using the securejoin library, effectively preventing path traversal attacks. Organizations using kaniko in their container build processes should prioritize this update to mitigate the risk of unauthorized file writes and potential code execution. Additionally, it is recommended to review and restrict access to registry authentication mechanisms and docker credential helpers to further reduce the attack surface.