apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-42575 · CVE overview and exploitation status

EUVD-2026-28933

GHSA-hcwr-pq9g-rq3m

GO-2026-5422

cve-program · CVE-2026-42575

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m
• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7

euvd · EUVD-2026-28933

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m
• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7

nvd · CVE-2026-42575

• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m

osv · GHSA-hcwr-pq9g-rq3m

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m
• https://nvd.nist.gov/vuln/detail/CVE-2026-42575
• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa
• https://github.com/chainguard-dev/apko
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7

osv · GO-2026-5422

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m
• https://nvd.nist.gov/vuln/detail/CVE-2026-42575
• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7

No related changes are available here.