Apko CVE-2026-54174
HIGH
GHSA-fpg8-7664-jc5q
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attacker needs a privileged MITM/cache/mirror position (AC:H) and a victim build (UI:R); no auth (PR:N); poisoned packages flow into downstream images (S:C) with full integrity/confidentiality/availability impact.
Primary rating from Vendor (https://github.com/chainguard-dev/melange).
CVSS VectorVendor: https://github.com/chainguard-dev/melange
Lifecycle Timeline
1DescriptionCVE.org
Previously, Apko verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.
AnalysisAI
Integrity bypass in Chainguard's apko (and the shared logic in melange) allows a network attacker to swap the actual installed contents of an apk package while its signature check still passes, because apko validated only the control-section hash (.PKGINFO) against the signed APKINDEX and never verified the data-section hash. Anyone able to compromise a package mirror, poison a fetch cache, or MITM the download can therefore inject arbitrary files into images built with these tools. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
Apko and melange build apk-format container images (the Wolfi/Chainguard OS ecosystem). An apk package is a tar stream split into a signed control section (metadata such as .PKGINFO plus the package hash records) and a data section (the real files installed onto the filesystem). Trust in apk is anchored in a signed APKINDEX that pins per-package hashes. The defect maps to CWE-345 (Insufficient Verification of Data Authenticity): the code confirmed the control-section hash matched the signed index but skipped verifying the data-section hash, so the cryptographic guarantee covered only the metadata and not the payload it was supposed to protect. CPE data confirms both affected components are Go modules: pkg:go/chainguard.dev_apko and pkg:go/chainguard.dev_melange.
RemediationAI
Patch available per vendor advisory: upgrade apko and melange to the fixed releases described in GHSA-fpg8-7664-jc5q (https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q); the input did not include an exact fixed version, so confirm the precise tag from that advisory before pinning. Until upgraded, reduce exposure to the AC:H precondition: fetch packages only over TLS from trusted first-party mirrors and pin/verify mirror endpoints (removes the MITM vector at the cost of losing convenient public mirrors); disable or isolate shared build caches, or treat cache contents as untrusted and rebuild from clean sources (trade-off: slower builds, lost cache reuse); and run builds on trusted network segments rather than shared or public networks. These controls narrow the attack surface but do not replace the code fix, which is the only measure that restores data-section hash verification.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today