Chainguard-dev vulnerabilities

Products

• Apko 10
• Melange 9
• Malcontent 3

Newest

• chainguard-dev apko apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root CVE-2026-105768 6.3 MediumOctober 5, 2026
• chainguard-dev apko, melange +1 more melange: Incomplete package integrity verification allows data section substitution CVE-2026-54174 Fix available 8.3 HighJuly 10, 2026
• chainguard-dev apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) CVE-2026-42575 Fix available 7.5 HighMay 4, 2026
• chainguard-dev apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root CVE-2026-42574 Fix available 7.5 HighMay 4, 2026
• chainguard-dev apko apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery CVE-2026-42576 Fix available 6.5 MediumMay 4, 2026
• chainguard melange melange has Path Traversal via .PKGINFO in --persist-lint-results CVE-2026-29051 Fix available 4.4 MediumApril 23, 2026
• chainguard melange melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVE-2026-29050 Fix available 6.1 MediumApril 23, 2026
• chainguard melange melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI CVE-2026-29049 Fix available 4.3 MediumMarch 2, 2026
• chainguard malcontent malcontent's nested archive extraction failure can drop content from scan inputs CVE-2026-28407 Fix available 6.9 MediumFebruary 27, 2026
• chainguard melange melange has a path traversal in license-path which allows reading files outside workspace CVE-2026-25145 Fix available 5.5 MediumFebruary 4, 2026
• chainguard melange melange affected by potential host command execution via license-check YAML mode patch pipeline CVE-2026-25143 Fix available 7.8 HighFebruary 4, 2026
• chainguard apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams CVE-2026-25140 Fix available 7.5 HighFebruary 4, 2026
• chainguard apko apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams CVE-2026-25122 Fix available 5.5 MediumFebruary 3, 2026
• chainguard apko apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base CVE-2026-25121 Fix available 7.5 HighFebruary 3, 2026
• chainguard melange melange pipeline working-directory could allow command injection CVE-2026-24844 Fix available 7.8 HighFebruary 3, 2026
• chainguard melange melange QEMU runner could write files outside workspace directory CVE-2026-24843 Fix available 8.2 HighFebruary 3, 2026
• chainguard malcontent malcontent's archive extraction could write outside extraction directory CVE-2026-24846 Fix available 5.5 MediumJanuary 29, 2026
• chainguard malcontent malcontent's OCI image scanning could expose registry credentials CVE-2026-24845 Fix available 6.5 MediumJanuary 29, 2026
• chainguard-dev melange melange creates SBOM files in APKs with world-writable permissions CVE-2025-54059 Fix available 4.4 MediumJuly 18, 2025
• chainguard-dev apko apko has incorrect permission (0666) in /etc/ld.so.cache and other files CVE-2025-53945 Fix available 7.0 HighJuly 18, 2025
• chainguard-dev apko apko Exposure of HTTP basic auth credentials in log output CVE-2024-36127 Fix available 7.5 HighJune 3, 2024