CVE-2026-54174: melange: Incomplete package integrity verification allows data section substitution Previously, Apko verified the control section hash (`.PKGINFO` etc.)…

high

melange: Incomplete package integrity verification allows data section substitution Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
chainguard.dev	apko	>= 0 < 1.2.9	1.2.9
chainguard.dev	melange	>= 0 < 0.50.4	0.50.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.