« Volver al listado

CVE-2026-42575

Estado: AplazadaAlta (7.5)—

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en aplicación expuesta (apko) sin autenticación (PR:N, UI:N). Impacto: cadena de suministro mediante sustitución de paquetes .apk sin validar checksums, permitiendo inyectar código arbitrario en imágenes OCI.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningUpdate SoftwarePrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network Traffic

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Chainguard — ApkoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42575",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42575",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-13T17:16:25.317424Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "chainguard-dev",
          "product": "apko",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-09T20:16:29.573",
  "references": [
    {
      "url": "https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        },
        {
          "lang": "en",
          "value": "CWE-494"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7."
    },
    {
      "lang": "es",
      "value": "apko permite a los usuarios construir y publicar imágenes de contenedor OCI construidas a partir de paquetes apk. Antes de la versión 1.2.7, apko verifica la firma en APKINDEX.tar.gz pero nunca compara los paquetes .apk descargados individualmente con la suma de verificación registrada en el índice firmado. La suma de verificación se analiza y está disponible a través de ChecksumString(), y el hash de control del paquete descargado se calcula, pero los dos valores nunca se comparan en getPackageImpl(). Los paquetes no coincidentes son aceptados silenciosamente. Un atacante que puede sustituir las respuestas de descarga (mirror comprometido, repositorio HTTP, caché CDN envenenada) puede instalar paquetes arbitrarios en las imágenes construidas. Este problema ha sido parcheado en la versión 1.2.7."
    }
  ],
  "lastModified": "2026-07-24T20:10:00.147",
  "sourceIdentifier": "security-advisories@github.com"
}