{"answers":{"affected":"3 open source packages ship an affected version, including chainguard.dev/apko.","exploited":"There is no known exploitation of CVE-2026-42575 in the wild and no public exploit code.","fix":"Upgrade chainguard.dev/apko to 1.2.7 or later.","what":"CVE-2026-42575 is a high-severity vulnerability in chainguard-dev apko, published on 9 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-42575 and fix it if it is affected.\n\nWhat it is: CVE-2026-42575 is a high-severity vulnerability in chainguard-dev apko, published on 9 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-42575 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- chainguard.dev/apko (Go): affected all versions; fixed in 1.2.7\n- chainguard.dev/apko (Go): affected all versions; fixed in 1.2.7\n- chainguard.dev/apko (Go): affected all versions; fixed in 1.2.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-42575/ (Markdown: https://insights.sbomify.com/CVE-2026-42575/index.md)","id":"CVE-2026-42575","markdown":"https://insights.sbomify.com/CVE-2026-42575/index.md","name":"CVE-2026-42575","record":{"aliases":["CLEANSTART-2026-SY69656","GHSA-hcwr-pq9g-rq3m","GO-2026-5422","MINI-4rx3-rv43-cww4","MINI-7vj8-gqqv-55rj","MINI-8m8f-gpvp-f7x4"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"upgrade","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"apko container builder","requires_auth":"none","summary":"Attackers can substitute malicious APK packages during image builds because apko fails to verify downloaded package checksums against the signed index.","user_interaction":"not_required","vuln_class":"supply_chain"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-494","name":"Download of Code Without Integrity Check"},{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"description":"apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)","id":"CVE-2026-42575","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"supply_chain","year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery","id":"CVE-2026-42576"},"packages":[{"ecosystem":"Go","fixed":["1.2.7"],"introduced":["0"],"last_affected":[],"package":"chainguard.dev/apko","purl":null,"source":"GHSA-hcwr-pq9g-rq3m"},{"ecosystem":"Go","fixed":["1.2.7"],"introduced":["0"],"last_affected":[],"package":"chainguard.dev/apko","purl":"pkg:golang/chainguard.dev/apko","source":"GHSA-hcwr-pq9g-rq3m"},{"ecosystem":"Go","fixed":["1.2.7"],"introduced":["0"],"last_affected":[],"package":"chainguard.dev/apko","purl":"pkg:golang/chainguard.dev/apko","source":"GO-2026-5422"}],"prev":{"headline":"apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root","id":"CVE-2026-42574"},"products":["apko"],"published":"2026-05-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-13","vendors":["chainguard-dev"]},"summary":"Attackers can substitute malicious APK packages during image builds because apko fails to verify downloaded package checksums against the signed index.","url":"https://insights.sbomify.com/CVE-2026-42575/"}