GO-2026-4503 vulnerabilities

Vulnerabilities for packages: k3s, chezmoi, timestamp-authority, db-operator, sops, rekor, amass, certificate-transparency, apko, age, juicefs, kubeflow-pipelines, spire-server, openfga, ratify, argo-workflows, seaweedfs, mattermost, sqlexporter, tailscale, grafana-alloy, fulcio, dbmate, gitsign,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: policy-controller, trivy, rekor, apko, spire-server, flux-source-controller, zarf, gitsign, sigstore-scaffolding, kubescape, slsa-verifier, vexctl, zot, melange, tekton-chains, wolfictl, gh, neuvector-sigstore-interface, falcoctl, tkn, cosign, aactl...

SUSE CVE-2026-42575

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

CLEANSTART-2026-UC75488 Security fixes in apko 1.2.13-r0

Package apko version 1.2.13-r0 fixes 24 vulnerabilities: ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29, CVE-2026-45570, CVE-2026-45571...

CLEANSTART-2026-IZ40410 Security fixes in apko 1.2.3-r0

Package apko version 1.2.3-r0 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

CLEANSTART-2026-FT78287 Security fixes in apko 1.2.2-r0

Package apko version 1.2.2-r0 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

GO-2026-5968 melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko...

CLEANSTART-2026-CV49545 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-3xc5-wrhm-f963, ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29 applied in versions: 1.2.13-r0, 1.2.2-r0

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WU14778 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 1.2.15-r1

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63674

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63765

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: k3s, chezmoi, go-discover, apko, hcloud, containerd, cilium, dagger, ksops, minio, zot, gitlab-runner, step, tekton-chains, step-issuer, rancher-machine, terraform-provider-azurerm, pulumi-language-java, act, argo-cd, aactl, cloud-provider-aws, falco-no-driver,...

GO-2026-5589 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko...

GO-2026-5422 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko

apko doesn't verify downloaded apk packages against APKINDEX checksum package substitution possible in chainguard.dev/apko...

GO-2026-5497 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko

apko DiscoverKeys has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko...

CLEANSTART-2026-VD09973 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-3xc5-wrhm-f963, ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29 applied in versions: 1.2.13-r0, 1.2.2-r0

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OS93204 Security fixes for CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, ghsa-389r-gv7p-r3rp, ghsa-3xc5-wrhm-f963, ghsa-m3xc-h892-ggx6, ghsa-qw64-3x98-g7q2 applied in versions: 1.2.2-r0, 1.2.2-r1

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: argo-cd, kubevela-fips, grafana-fips, trufflehog-fips, cg, kubescape-server, trivy, gitea, cloudbeat, chainctl, argo-workflows, k9s-fips, kubescape, xeol-fips, gitaly, zarf-fips, kubevela, kubescape-server-fips, dagger, snyk-cli, argo-events, guac, coder-fips, apko,...

CVE-2026-42574

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

CVE-2026-42575

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...