PT-2026-36990 · Apko · Apko

1Seal · Published 2026-05-04 · Updated 2026-05-10 · CVE-2026-42575

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions apko (affected versions not specified)

Description apko verifies the signature on 'APKINDEX.tar.gz' but fails to compare individually downloaded '.apk' packages against the checksum recorded in the signed index. Although the checksum is parsed via ChecksumString() and the downloaded package control hash is computed, these values are not compared within the getPackageImpl() function. This allows mismatched packages to be silently accepted. An attacker capable of substituting download responses, such as through a compromised mirror, HTTP repository, or poisoned CDN cache, could install arbitrary packages into built images.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-494

CWE-345

Related Identifiers

CVE-2026-42575

GHSA-HCWR-PQ9G-RQ3M

Affected Products

Apko

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-42575 · Security Note
• https://osv.dev/vulnerability/GHSA-hcwr-pq9g-rq3m · Vendor Advisory
• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa · Note
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 · Note
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m · Note
• https://github.com/chainguard-dev/apko · Note
• https://twitter.com/CVEnew/status/2053559125175349729 · Twitter Post
• https://twitter.com/dailycve/status/2051466110084567335 · Twitter Post
• https://t.me/CVEtracker/53237 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1t4h1c4/resumen_diario_de_vulnerabilidades_05052026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2053226673240190996 · Twitter Post