Vulnerability details

CVE-2026-42575

chainguard-dev apko

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

CVSS 3.1

7.5High

Official description

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
chainguard-dev	apko	< 1.2.7	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m x_refsource_CONFIRM
https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa x_refsource_MISC
https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-09
Last updated: 2026-05-13
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.15%

Probability of exploitation in 30 days

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-345
Insufficient Verification of Data Authenticity
CWE-494
Download of Code Without Integrity Check