{"id":"CVE-2026-54174","sourceIdentifier":"security-advisories@github.com","published":"2026-09-11T21:17:11.403","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"chainguard-dev","product":"melange","versions":[{"version":"< 0.50.4","status":"affected"}]},{"vendor":"chainguard-dev","product":"apko","versions":[{"version":"< 1.2.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-14T16:18:49.717621Z","id":"CVE-2026-54174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-354"}]}],"references":[{"url":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q","source":"security-advisories@github.com"}]}