PT-2026-37053 · Apko · Apko

1Seal · CVE-2026-42576 · Published 2026-05-04 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions apko versions prior to 1.2.7

Description The DiscoverKeys() function in pkg/apk/apk/implementation.go performs an unconditional type-assertion of JWKS (JSON Web Key Set) keys as *rsa.PublicKey without verifying the key type. If a repository JWKS endpoint returns a non-RSA key, such as an Elliptic Curve (EC) key, the unchecked assertion causes a panic and crashes the application. This affects any workflow that initializes the APK database and fetches repository keys.

Recommendations Update to version 1.2.7.

Exploit

Fix

DoS

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2026-42576

GHSA-M7HM-VM4X-28JF

GO-2026-5497

OPENSUSE-SU-2026:21483-1

Affected Products

Apko

References · 1748

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42576.json · Exploit
• https://osv.dev/vulnerability/GHSA-m7hm-vm4x-28jf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42576 · Security Note
• https://osv.dev/vulnerability/GO-2026-5497 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42576 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 · Note
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf · Note
• https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1 · Note
• https://github.com/chainguard-dev/apko · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note