What is the CVSS score of CVE-2026-42575?

CVE-2026-42575 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of apko are affected by CVE-2026-42575?

Chainguard apko versions prior to 1.2.7 contain a package substitution vulnerability that allows network-positioned attackers to inject malicious APK packages into container images during the build…. A patch is available.

How to fix or mitigate CVE-2026-42575?

Within 24 hours: Inventory all systems using Chainguard apko and identify current versions in use; disable or isolate apko build pipelines if versions prior to 1.2.7 are confirmed. Within 7 days: Upgrade Chainguard apko to version 1.2.7 or later across all build environments and CI/CD systems; validate upgrade completion. Within 30 days: Re-scan and validate integrity of all container images built with vulnerable apko versions using cryptographic verification; consider rebuilding critical images with patched tooling.

apko CVE-2026-42575

HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-05-04 https://github.com/chainguard-dev/apko

GHSA-hcwr-pq9g-rq3m

Information Disclosure

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 04, 2026 - 21:47 vuln.today

Analysis Generated

May 04, 2026 - 21:47 vuln.today

DescriptionGitHub Advisory

apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images.

Fix: No fix available yet.

Acknowledgements

apko thanks Oleh Konko from 1seal for discovering and reporting this issue.

AnalysisAI

Package substitution in Chainguard apko allows network-positioned attackers to inject arbitrary APK packages into container images during build. apko verifies APKINDEX.tar.gz signatures but fails to validate individual downloaded .apk packages against signed index checksums, accepting mismatched packages silently. Attackers controlling download responses (compromised mirrors, HTTP repositories, poisoned CDN caches) can replace legitimate packages with malicious ones. Fixed in version 1.2.7. CVSS 7.5 with network vector and no authentication required. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation at time of analysis.

Technical ContextAI

apko is a Go-based tool from Chainguard for building Alpine Linux-based container images from APK packages (pkg:go/chainguard.dev_apko). Alpine's package manager uses APKINDEX.tar.gz files containing package metadata and SHA checksums, cryptographically signed to ensure integrity. The vulnerability stems from incomplete implementation of the verification chain: apko correctly validates the APKINDEX.tar.gz signature and parses package checksums via ChecksumString(), and even computes control hashes for downloaded .apk files, but the critical comparison step in getPackageImpl() is missing. This is a CWE-345 (Insufficient Verification of Data Authenticity) flaw where the authentication mechanism exists but isn't fully enforced. The parsed checksum and computed hash exist in memory but are never compared, allowing packages with mismatched hashes to pass validation. This breaks the trust chain between the signed index and actual installed packages.

RemediationAI

Vendor-released patch: version 1.2.7 implements the missing checksum comparison. Upgrade apko to 1.2.7 or later immediately via 'go install chainguard.dev/apko@v1.2.7' or update container image builder pipelines using apko:1.2.7 image. Refer to advisory at https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m for release details. For environments unable to upgrade immediately: enforce HTTPS-only APK repositories with strict certificate validation to prevent MitM attacks (requires repository configuration changes and may break compatibility with HTTP-only mirrors). Use Alpine's official mirrors only, avoiding third-party or regional mirrors until patched. Scan existing apko-built images for integrity: compare installed package checksums against signed APKINDEX from trusted source, though this requires manual verification scripting. Rebuild all container images with patched apko 1.2.7 to ensure integrity. Note: HTTPS mitigation reduces but does not eliminate risk if CDN or mirror infrastructure is compromised at origin.