CVE-2026-54174: melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified…

PriorityP346high8.3CVSS 3.1

AVNACHPRNUIRSCCHIHAH

EPSS

0.15%

4.6th percentile

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
chainguard-dev	apko	< 1.2.9	1.2.9
chainguard-dev	melange	< 0.50.4	0.50.4
chainguard.dev	apko	>= 0 < 1.2.9	1.2.9
chainguard.dev	melange	>= 0 < 0.50.4	0.50.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.