CyberSecBulletin

Chainguard vulnerabilities

We track 2 vulnerabilities in Chainguard products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.

2vulnerabilities
1critical
1high
0exploited
9.1average CVSS score

Latest Chainguard vulnerabilities

  • 8.8 High severity

    MinIO: Improper Verification of Cryptographic Signature

    CVE-2026-122267Chainguard

    MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.

  • 9.3 Critical severity

    kaniko: Origin Validation Error

    CVE-2026-105769Chainguard

    kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which