Chainguard.Dev Apko vulnerabilities

CVE-2026-42574 [HIGH] CWE-22 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root ### Impact A crafted `.apk` could install a `TypeSymlink` tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the b

CVE-2026-25121 [HIGH] CWE-22 apko has a path traversal in apko dirFS which allows filesystem writes outside base apko has a path traversal in apko dirFS which allows filesystem writes outside base A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink me

CVE-2026-42575 [HIGH] CWE-345 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) apko verifies the signature on `APKINDEX.tar.gz` but never compares individually downloaded `.apk` packages against the checksum recorded in the signed index. The checksum is parsed and available via `ChecksumString()`, and the downloaded package control hash is co

CVE-2026-25140 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko

CVE-2024-36127 [HIGH] CWE-522 apko Exposure of HTTP basic auth credentials in log output apko Exposure of HTTP basic auth credentials in log output ### Summary Exposure of HTTP basic auth credentials from repository and keyring URLs in log output ### Details There was a handful of instances where the `apko` tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons: 1. The`%s` verb was used to format a `url.URL` as a st

CVE-2026-42576 [MEDIUM] CWE-704 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery `DiscoverKeys` in `pkg/apk/apk/implementation.go` unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that in

CVE-2025-53945 [HIGH] CWE-276 apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files It was discovered that the ld.so.cache in images generated by apko had file system permissions mode `0666`: ``` bash-5.3# find / -type f -perm -o+w /etc/ld.so.cache ``` This issue was introduced in commit [04f37e2 ("generate /etc/ld.so.cache (#1629)")](https://github.com/chaing

CVE-2026-25122 [MEDIUM] CWE-400 apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams `expandapk.Split` drains the first gzip stream of an APK archive via `io.Copy(io.Discard, gzi)` without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). T

CVE-2026-54174 [HIGH] CWE-345 melange: Incomplete package integrity verification allows data section substitution melange: Incomplete package integrity verification allows data section substitution Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary fil