GO-2026-5968 melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko...

CLEANSTART-2026-CV49545 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-3xc5-wrhm-f963, ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29 applied in versions: 1.2.13-r0, 1.2.2-r0

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WU14778 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 1.2.15-r1

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: kargo, nerdctl, docker, kine, pulumi-language-java, age, pulumi, rootlesskit, sops, flux-notification-controller, aactl, terraform-provider-azurerm, zarf, dagger, slsa-verifier, chisel, docker-machine-driver-harvester, trivy, cosign, pulumi-language-yaml, buildah,...

GO-2026-5497 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko

apko DiscoverKeys has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko...

GO-2026-5422 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko

apko doesn't verify downloaded apk packages against APKINDEX checksum package substitution possible in chainguard.dev/apko...

CLEANSTART-2026-VD09973 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-3xc5-wrhm-f963, ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29 applied in versions: 1.2.13-r0, 1.2.2-r0

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OS93204 Security fixes for CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, ghsa-389r-gv7p-r3rp, ghsa-3xc5-wrhm-f963, ghsa-m3xc-h892-ggx6, ghsa-qw64-3x98-g7q2 applied in versions: 1.2.2-r0, 1.2.2-r1

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: mapotf-fips, kubevela-fips, argo-cd-fips, steampipe, pulumi-language-yaml, pulumi-language-dotnet, trivy-operator, trivy, external-secrets-operator, grype-db, witness, grafana-alloy-fips, crossplane, gitea, dagger, osv-scanner, k9s-fips, zarf, packer-fips,...

CVE-2026-42574

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

CVE-2026-42575

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

CVE-2026-42574

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

CVE-2026-42576 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...

EUVD-2026-28934

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...

CVE-2026-42576 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...

CVE-2026-42575

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

CVE-2026-42575 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

CVE-2026-42575 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

CVE-2026-42575

CVE-2026-42575 affects chainguard/apko: before v1.2.7, apko verifies APKINDEX.signed index but does not compare individually downloaded .apk checksums to the index checksum. The ChecksumString() is parsed but never cross-checked with the downloaded package’s control hash in getPackageImpl(), allo...

CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...