CVE-2026-28406: 
NixOS vulnerability analysis and mitigation

CVE-2026-28406 is a path traversal vulnerability in kaniko, a tool for building container images from Dockerfiles inside containers or Kubernetes clusters. Affecting versions 1.25.4 through 1.25.9, the flaw allows an attacker to write arbitrary files outside the intended build context destination directory during tar archive extraction. It was discovered by Oleh Konko from 1seal, disclosed on February 27, 2026, and patched in version 1.25.10. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Kaniko's ExtractFile and UnTar functions used filepath.Join(dest, cleanedName) to resolve tar entry paths without verifying that the resulting path remained within the dest directory. A maliciously crafted tar entry with a name like ../outside.txt or foo/../../outside.txt would resolve to a path outside the extraction root, enabling arbitrary file writes. In environments with registry authentication configured, this file write primitive can be chained with Docker credential helpers to achieve code execution within the kaniko executor process. The fix, merged via PR #326, replaces the unsafe filepath.Join calls with securejoin.SecureJoin from the github.com/cyphar/filepath-securejoin library, which enforces path confinement (Github Advisory, Fix PR).

Successful exploitation allows an attacker to write arbitrary files anywhere on the filesystem accessible to the kaniko executor process, potentially overwriting critical system files, configuration files, or application binaries. In the more severe attack scenario — environments with registry authentication — the path traversal can be chained with Docker credential helpers to achieve arbitrary code execution within the kaniko executor process, granting full control over the container build environment. The CVSS scoring reflects high integrity impact and low availability impact, with no direct confidentiality impact, though code execution could enable secondary data exfiltration (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.075% (23rd percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported. Exploitation requires the ability to supply a malicious build context archive to a vulnerable kaniko instance, which may be feasible in multi-tenant CI/CD environments or pipelines that accept user-supplied build contexts (Github Advisory).

1. Identify a vulnerable target: Locate a CI/CD pipeline or Kubernetes cluster running kaniko versions 1.25.4 through 1.25.9 that accepts user-supplied or externally sourced build context archives.
2. Craft a malicious tar archive: Create a tar archive containing one or more entries with path-traversal names, such as ../outside.txt or foo/../../etc/cron.d/malicious, designed to write files outside the intended extraction directory.

   python3 -c "
   import tarfile, io
   buf = io.BytesIO()
   with tarfile.open(fileobj=buf, mode='w') as tf:
    data = b'malicious content'
    info = tarfile.TarInfo(name='../outside.txt')
    info.size = len(data)
    tf.addfile(info, io.BytesIO(data))
   buf.seek(0)
   open('malicious.tar', 'wb').write(buf.read())
   "

3. Submit the malicious build context: Supply the crafted tar archive as the build context to the kaniko executor (e.g., via a Dockerfile build trigger, a Kubernetes Job, or a CI pipeline that passes user-controlled context).
4. Achieve file write outside destination: Kaniko extracts the tar entry using the unsafe filepath.Join(dest, cleanedName), writing the file to the traversed path outside the build context directory.
5. Chain with credential helpers for code execution (if registry auth is configured): If the target environment has Docker registry authentication configured, overwrite a Docker credential helper binary or configuration file (e.g., in ~/.docker/config.json or a helper script on $PATH) with a malicious payload. When kaniko subsequently invokes the credential helper during image push/pull, the attacker's code executes within the executor process (Github Advisory, Fix PR).

• File System: Unexpected files appearing outside the kaniko build context directory (e.g., in /, /etc/, /tmp/, or home directories of the service account running kaniko); modified Docker credential helper binaries or scripts; unexpected entries in /etc/cron.d/ or other persistence locations.
• Logs: Kaniko executor logs showing tar extraction of entries with ../ in their names; errors or unexpected behavior from Docker credential helpers during image push/pull operations; file write operations to paths outside the expected build context root.
• Process: Unexpected child processes spawned by the kaniko executor process, particularly shells (/bin/sh, /bin/bash) or network utilities (curl, wget, nc) that are not part of normal build operations.
• Network: Unexpected outbound connections from the kaniko executor container to external hosts, particularly after image push/pull operations involving registry authentication.

Upgrade kaniko to version 1.25.10 or later, which replaces the vulnerable filepath.Join path resolution with securejoin.SecureJoin to enforce path confinement during tar extraction (Github Advisory, Fix Commit). As interim mitigations, restrict the sources of build context archives to trusted, validated inputs only, and avoid accepting user-supplied build contexts in shared or multi-tenant environments. Additionally, limit registry authentication credentials to the minimum necessary permissions and run kaniko in isolated or sandboxed environments to reduce the blast radius of exploitation (Red Hat Bugzilla).

Red Hat tracked the vulnerability via their security response process (Bugzilla bug 2443462) and classified it as high severity. The fix was reviewed and approved by multiple kaniko maintainers (antitree, egibs) and merged on February 27, 2026. Some community users reported regressions introduced by the initial fix (PR #326), including symlink resolution errors in certain image builds, which were subsequently addressed in a follow-up PR #330. The vulnerability was acknowledged with credit to Oleh Konko from 1seal for responsible disclosure (Github Advisory, Fix PR).