CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution
Attackers can substitute package contents during fetches because data section hashes are not verified, allowing malicious code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54174?
CVE-2026-54174 is a high-severity vulnerability in chainguard-dev apko, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.
Which versions are affected by CVE-2026-54174?
6 open source packages ship an affected version, including chainguard.dev/apko and chainguard.dev/melange.
| Package | Affected | Fixed in |
|---|---|---|
chainguard.dev/apko Go | All versions | 1.2.9 |
chainguard.dev/apko Go | All versions | 1.2.9 |
chainguard.dev/apko Go | All versions | 1.2.9 |
chainguard.dev/melange Go | All versions | 0.50.4 |
chainguard.dev/melange Go | All versions | 0.50.4 |
chainguard.dev/melange Go | All versions | 0.50.4 |
Linux distribution packages (1)
apko openSUSE:Tumbleweed | All versions | 1.4.4-1.1 |
How do I fix CVE-2026-54174?
Upgrade chainguard.dev/apko to 1.2.9 or later.
Is CVE-2026-54174 being exploited?
There is no known exploitation of CVE-2026-54174 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-DP32029, CLEANSTART-2026-MS06455, GHSA-fpg8-7664-jc5q, GO-2026-5968, MINI-2v5v-3h24-46w9, MINI-mc47-6rpp-9mx5 and 1 more.