Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
googlecontainertools/kaniko
main @ 236ba56
12
Fixes
1
CVEs
HIGH
Peak severity
83.3%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
pkg/commands/run.go: most-fixed (3 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Improper path canonicalization and verification of symlinks during build commands (COPY/ADD) can lead to directory traversal outside of the container build root, potentially allowing malicious configurations to overwrite critical host files. This risk is also validated by CVE-2026-28406.
Auth Bypass: Misconfiguration or overwriting of process credentials can cause commands intended to run under a restricted non-root container user to execute with full root privileges, fully bypassing the container's user boundaries.
Privilege Escalation: Failing to resolve correct primary GIDs from user databases like /etc/passwd can result in incorrect credential fallback (such as GID 0), unintentionally running code with elevated group rights.