Skip to content
Chainguard-dev Apko vulnerabilities
-
chainguard-dev apko
apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root
CVE-2026-105768
6.3 Medium
-
chainguard-dev apko, melange +1 more
melange: Incomplete package integrity verification allows data section substitution
CVE-2026-54174
Fix available
8.3 High
-
chainguard-dev apko
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
CVE-2026-42575
Fix available
7.5 High
-
chainguard-dev apko
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
CVE-2026-42574
Fix available
7.5 High
-
chainguard-dev apko
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
CVE-2026-42576
Fix available
6.5 Medium
-
chainguard apko
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
CVE-2026-25140
Fix available
7.5 High
-
chainguard apko
apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
CVE-2026-25122
Fix available
5.5 Medium
-
chainguard apko
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
CVE-2026-25121
Fix available
7.5 High
-
chainguard-dev apko
apko has incorrect permission (0666) in /etc/ld.so.cache and other files
CVE-2025-53945
Fix available
7.0 High
-
chainguard-dev apko
apko Exposure of HTTP basic auth credentials in log output
CVE-2024-36127
Fix available
7.5 High