3 Total advisories
3 Vulnerabilities
0 Malware
Dependency scanning
Check whether github.com/chainguard-dev/kaniko is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
CRITICAL 9.3
CVE-2026-105769
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
HIGH 8.2
CVE-2026-28406
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories
UNKNOWN
CVE-2026-28406
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko
Browse more Go advisories
Learn What is SAST?
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes