{"id":"EUVD-2026-76767","enisaUuid":"e3f7bcfe-1788-3425-b11e-6dced0aa7f31","description":"melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.","datePublished":"Sep 11, 2026, 9:05:30 PM","dateUpdated":"Sep 14, 2026, 4:19:01 PM","baseScore":8.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q\n","aliases":"CVE-2026-54174\nGHSA-fpg8-7664-jc5q\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"1e137e2d-8e2b-35c5-a03c-7124582fadad","product":{"name":"melange","vendor":{"name":"chainguard-dev"}},"product_version":"\u003c 0.50.4"},{"id":"4114646c-5b53-31f3-86f1-7f39c930922c","product":{"name":"apko","vendor":{"name":"chainguard-dev"}},"product_version":"\u003c 1.2.9"}],"enisaIdVendor":[{"id":"9c9ed031-bf00-3072-ac9e-7b36c6eeaf98","vendor":{"name":"chainguard-dev"}}],"enisaIdVulnerability":[{"id":"982465ee-4710-338d-983f-047c74ca94fd","vulnerability":{"id":"CVE-2026-54174","description":"melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.","datePublished":"Sep 11, 2026, 9:05:30 PM","dateUpdated":"Sep 14, 2026, 4:19:01 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q\n","enisa_id":"EUVD-2026-76767\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"7e47540b-852b-39b0-9ef2-17b48a3a032a","product":{"name":"melange","vendor":{"name":"chainguard-dev"}},"product_version":"\u003c 0.50.4"},{"id":"f60ebddd-f419-3e42-b884-23194cc4ac41","product":{"name":"apko","vendor":{"name":"chainguard-dev"}},"product_version":"\u003c 1.2.9"}],"vulnerabilityVendor":[{"id":"38d2b393-a55a-33c2-a70a-5fec7709d5b0","vendor":{"name":"chainguard-dev"}}]}},{"id":"a416d09e-4240-344f-a473-0c739ce3d86c","vulnerability":{"id":"GHSA-fpg8-7664-jc5q","description":"melange: Incomplete package integrity verification allows data section substitution","datePublished":"Jul 10, 2026, 9:43:05 PM","dateUpdated":"Jul 10, 2026, 9:43:05 PM","baseScore":0.0,"references":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q\nhttps://github.com/chainguard-dev/melange\n","enisa_id":"EUVD-2026-76767\n","aliases":"CVE-2026-54174\nGHSA-fpg8-7664-jc5q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"a38570c1-c70f-3e40-8ce9-b29babaa4b15","advisory":{"id":"openSUSE-SU-2026:11829-1","description":"apko-1.4.4-1.1 on GA media","summary":"apko-1.4.4-1.1 on GA media","datePublished":"Sep 21, 2026, 12:00:00 AM","dateUpdated":"Sep 22, 2026, 9:43:34 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11829-1.json\nhttps://www.suse.com/security/cve/CVE-2026-54174/\n","aliases":"CVE-2026-54174\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"089ad97c-bbca-399e-a515-1e0cff15df94","product":{"name":"apko-0:1.4.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"136a601d-802d-327e-a14a-693dd5d987fa","product":{"name":"apko-zsh-completion-0:1.4.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"187df66b-096f-34a4-aa05-321073c98a0c","product":{"name":"apko-fish-completion-0:1.4.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1cebf890-bbd2-3508-acbf-13b6c9392427","product":{"name":"apko-zsh-completion-0:1.4.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4572fcf2-2b65-3148-a301-60505a304c1e","product":{"name":"apko-0:1.4.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"471fdf40-37a6-3ce4-a0e0-a3a76f6ddc94","product":{"name":"apko-zsh-completion-0:1.4.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7167b90d-8975-3df1-8a2d-047576f028ca","product":{"name":"apko-bash-completion-0:1.4.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"80580f6b-4efc-3fd1-9cb5-1ec5c6f866b9","product":{"name":"apko-fish-completion-0:1.4.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"81452cf7-e0bc-3ae2-978c-0c117ec1437f","product":{"name":"apko-fish-completion-0:1.4.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"87919d9c-3545-3ac7-a4b2-c53c5e57c457","product":{"name":"apko-0:1.4.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"9c8b3135-1494-3890-9f7f-dfd892dd9b50","product":{"name":"apko-bash-completion-0:1.4.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c1bcd564-4346-36ae-aa00-64347ea480e1","product":{"name":"apko-0:1.4.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e1fedc6c-b6f1-3b66-b0dd-2fd8c6fd5b1a","product":{"name":"apko-bash-completion-0:1.4.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e3a96222-5e07-3a82-ae42-0c45f5395f78","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"e649cc19-98cb-3af6-be9b-c0c5e4d8aa03","product":{"name":"apko-bash-completion-0:1.4.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f79fe3ed-395d-3033-a1f3-8dc20c288250","product":{"name":"apko-zsh-completion-0:1.4.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f91f4185-e340-3d7e-9a47-1a1c14aebb3c","product":{"name":"apko-fish-completion-0:1.4.4-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}