SUSE CVE-2026-42576

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...

CVE-2026-42576

creationtimestamp| type| source ---|---|--- 2026-05-09 21:44:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlh7qghol32h...