Affected by GO-2026-4580
and 1 other vulnerabilities
GO-2026-4580: kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko
GO-2026-6902: kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko