chainguard-dev apko vulnerabilities

Latest chainguard-dev apko CVEs

Newest publication first

1. CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

   Published 2026-09-11

   High·CVSS 8.3 EPSS 0.16%

   melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actu...

2. CVE-2026-42576 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

   Published 2026-05-09

   Medium·CVSS 6.5 EPSS 0.25%

   apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns...

3. CVE-2026-42575 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

   Published 2026-05-09

   High·CVSS 7.5 EPSS 0.16%

   apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is...

4. CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

   Published 2026-05-09

   High·CVSS 7.5 EPSS 0.35%

   apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write en...

5. CVE-2026-25140 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

   Published 2026-02-04

   High·CVSS 7.5 EPSS 0.41%

   apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/ex...

6. CVE-2026-25121 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base

   Published 2026-02-04

   High·CVSS 7.5 EPSS 0.41%

   apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromi...

7. CVE-2026-25122 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

   Published 2026-02-04

   Medium·CVSS 5.5 EPSS 0.13%

   apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream,...

8. CVE-2025-53945 apko has incorrect permission (0666) in /etc/ld.so.cache and other files

   Published 2025-07-18

   High·CVSS 7.0 EPSS 0.14%

   apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issu...

9. CVE-2024-36127 apko Exposure of HTTP basic auth credentials in log output

   Published 2024-06-03

   High·CVSS 7.5 EPSS 0.44%

   apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.