{"id":"CVE-2026-42575","sourceIdentifier":"security-advisories@github.com","published":"2026-05-09T20:16:29.573","lastModified":"2026-07-24T20:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7."},{"lang":"es","value":"apko permite a los usuarios construir y publicar imágenes de contenedor OCI construidas a partir de paquetes apk. Antes de la versión 1.2.7, apko verifica la firma en APKINDEX.tar.gz pero nunca compara los paquetes .apk descargados individualmente con la suma de verificación registrada en el índice firmado. La suma de verificación se analiza y está disponible a través de ChecksumString(), y el hash de control del paquete descargado se calcula, pero los dos valores nunca se comparan en getPackageImpl(). Los paquetes no coincidentes son aceptados silenciosamente. Un atacante que puede sustituir las respuestas de descarga (mirror comprometido, repositorio HTTP, caché CDN envenenada) puede instalar paquetes arbitrarios en las imágenes construidas. Este problema ha sido parcheado en la versión 1.2.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"chainguard-dev","product":"apko","versions":[{"version":"< 1.2.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-13T17:16:25.317424Z","id":"CVE-2026-42575","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-494"}]}],"references":[{"url":"https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa","source":"security-advisories@github.com"},{"url":"https://github.com/chainguard-dev/apko/releases/tag/v1.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m","source":"security-advisories@github.com"}]}