Remote Code Execution Vulnerability in apko by ChainGuard
CVE-2026-42575
7.5HIGH
What is CVE-2026-42575?
The apko tool, used for building and publishing OCI container images from apk packages, had a critical flaw prior to version 1.2.7. Although it verified the signature on APKINDEX.tar.gz, it failed to validate the individual .apk packages against the checksums recorded in the signed index. As a result, mismatched packages could be accepted without raising alerts, potentially allowing attackers to manipulate download responses and introduce malicious packages into built images. This significant security oversight has been addressed in apko version 1.2.7, which rectifies the checksum verification process.
Affected Version(s)
apko < 1.2.7