PT-2026-37053 · Apko · Apko

1Seal · Published 2026-05-04 · Updated 2026-05-10 · CVE-2026-42576

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions apko versions prior to 1.2.7

Description The DiscoverKeys() function in pkg/apk/apk/implementation.go performs an unconditional type-assertion of JWKS (JSON Web Key Set) keys as *rsa.PublicKey without verifying the key type. If a repository JWKS endpoint returns a non-RSA key, such as an Elliptic Curve (EC) key, the unchecked assertion causes a panic and crashes the application. This affects any workflow that initializes the APK database and fetches repository keys.

Recommendations Update to version 1.2.7.

Fix

DoS

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2026-42576

GHSA-M7HM-VM4X-28JF

Affected Products

Apko

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-42576 · Security Note
• https://osv.dev/vulnerability/GHSA-m7hm-vm4x-28jf · Vendor Advisory
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 · Note
• https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1 · Note
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf · Note
• https://github.com/chainguard-dev/apko · Note
• https://t.me/CVEtracker/53238 · Telegram Post
• https://twitter.com/CVEnew/status/2053559124256817342 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053231792748986476 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1t4h1c4/resumen_diario_de_vulnerabilidades_05052026 · Reddit Post