GHSA-hcwr-pq9g-rq3m

Suggest an improvement
Source
https://github.com/advisories/GHSA-hcwr-pq9g-rq3m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-hcwr-pq9g-rq3m/GHSA-hcwr-pq9g-rq3m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hcwr-pq9g-rq3m
Aliases
  • CVE-2026-42575
Downstream
Related
Published
2026-05-04T21:27:17Z
Modified
2026-05-05T19:14:20.528279833Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
Details

apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images.

Fix: No fix available yet.

Acknowledgements

apko thanks Oleh Konko from 1seal for discovering and reporting this issue.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T21:27:17Z",
    "cwe_ids": [
        "CWE-345",
        "CWE-494"
    ],
    "severity": "HIGH",
    "nvd_published_at": null
}
References

Affected packages

Go / chainguard.dev/apko

Package

Name
chainguard.dev/apko
View open source insights on deps.dev
Purl
pkg:golang/chainguard.dev/apko

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-hcwr-pq9g-rq3m/GHSA-hcwr-pq9g-rq3m.json"