apko CVE-2026-105768

Exploitation requires the attacker to control a package that apko installs into the image being built (a supply-chain foothold, not arbitrary remote access), and that package must ship an /etc/passwd or /etc/group entry whose UID or GID is out of uint32 range - e.g. 4294967296 (2^32), 4294968296, or a negative value like -1. The build must run apko version 0.2.0 up to (but not including) 1.4.5 on a 64-bit platform, where the value is truncated/wrapped to 0 rather than rejected (the committed fixture notes that 32-bit archive/tar writers reject such values before apko sees them, though the consumer's word size is what ultimately matters). LIMITING FACTORS: the attacker cannot act without first getting a crafted package into the build inputs, and the impact is confined to the produced image's ownership/run-as user; there is no confidentiality or availability impact on the build host itself.

This is a genuine but conditional supply-chain/privilege-escalation issue rather than a broadly exploitable remote flaw. The official CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium), and the AT:P (attack requirement) is the critical qualifier: exploitation is NOT possible by an arbitrary remote attacker - it requires the attacker to already control a package that apko installs into the image being built. Impact is integrity-only (VI/SI:L, VC:N/VA:N), consistent with an attacker silently promoting an entry to UID 0/GID 0 (root) in the produced image rather than stealing data from or crashing the build host. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis; the absence of KEV/EPSS signals means this is a 'patch in normal cycle' item, not an emergency, but the root-UID outcome makes it meaningful for anyone building apk/OCI images from untrusted or third-party packages. CONFLICT TO NOTE: the input Tag 'Information Disclosure' contradicts the CVSS vector, which sets VC:N (no confidentiality impact) - this is an integrity/privilege-escalation bug, not an information-disclosure bug.

An attacker who can get a malicious apk package included in an apko build (e.g., a compromised or typosquatted dependency package) ships an /etc/passwd or /etc/group entry declaring an out-of-range UID/GID such as 4294967296 (2^32) or -1. On a 64-bit build host apko's UserEntry.Parse/GroupEntry.Parse truncate or wrap that value to 0, so the entry - and any setuid binary or run-as user it governs - is written into the final image as root. No public exploit code was identified in the input data.