Is CVE-2026-28406 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28406 being exploited in the wild.

How severe is CVE-2026-28406?

High severity, with a CVSS score of 8.2, published 27 February 2026.

Which products and versions are affected?

github.com/chainguard-dev/kaniko (Go) SEMVER:introduced=1.25.4,fixed=1.25.10.

Is there a fix for CVE-2026-28406?

Yes. github.com/chainguard-dev/kaniko (Go): upgrade to 1.25.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28406 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-28406?

Check whether you run Chainguard Kaniko or github.com/chainguard-dev/kaniko (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28406: Google kaniko path traversal in tar extraction

CVE-2026-28406 · Severity: high · CVSS 8.2 · Published 2026-02-27

Kaniko, a tool used to build container images within Kubernetes and other container environments, contains a security flaw in how it handles file extraction. An attacker can provide a specially crafted build file that writes data to unauthorized locations on the host system. In certain configurations, this can be used to take control of the image building process and execute malicious code, potentially compromising the security of the build pipeline.

Vendors: Chainguard, Go.

Quick answers

Is CVE-2026-28406 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28406 being exploited in the wild.
How severe is CVE-2026-28406?: High severity, with a CVSS score of 8.2, published 27 February 2026.
Which products and versions are affected?: github.com/chainguard-dev/kaniko (Go) SEMVER:introduced=1.25.4,fixed=1.25.10.
Is there a fix for CVE-2026-28406?: Yes. github.com/chainguard-dev/kaniko (Go): upgrade to 1.25.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28406 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-28406?: Check whether you run Chainguard Kaniko or github.com/chainguard-dev/kaniko (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/chainguard-dev/kaniko (Go): upgrade to 1.25.10 or later
```
go get github.com/chainguard-dev/kaniko@v1.25.10
```

Technical details

A path traversal vulnerability (CWE-22) exists in kaniko's archive extraction logic. The tool uses `filepath.Join(dest, cleanedName)` to unpack build context archives without verifying that the resulting path remains within the target destination directory. By including tar entries with parent directory references (e.g., `../outside.txt`), an attacker can write files to arbitrary locations. In environments utilizing registry authentication, this primitive can be leveraged to overwrite docker credential helpers, leading to remote code execution (RCE) within the kaniko executor process. The issue is resolved in version 1.25.10 by implementing `securejoin` for path resolution.

Affected products

Google / Chainguard-forks kaniko >= 1.25.4, < 1.25.10
Red Hat OpenShift Serverless 1

Identifiers

CVE-2026-28406
GHSA-6rxq-q92g-4rmf
GO-2026-4580

Timeline

2026-02-26: other: Fix developed and pull request opened
2026-02-27: patched: Fix merged and version 1.25.10 released
2026-02-27: advisory: Initial advisory published by GitHub/Chainguard-forks
2026-02-27: disclosed: CVE-2026-28406 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.