« Volver al listado

CVE-2026-42576

Estado: AplazadaMedia (6.5)—

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Chainguard — ApkoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42576",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42576",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-11T14:57:52.451771Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "chainguard-dev",
          "product": "apko",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-09T20:16:29.717",
  "references": [
    {
      "url": "https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-704"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7."
    },
    {
      "lang": "es",
      "value": "apko permite a los usuarios construir y publicar imágenes de contenedor OCI construidas a partir de paquetes apk. Antes de la versión 1.2.7, DiscoverKeys en pkg/apk/apk/implementation.go afirma el tipo de las claves JWKS incondicionalmente como rsa.PublicKey sin verificar el tipo de clave. Si un endpoint JWKS de repositorio devuelve una clave que no es RSA (p. ej., EC), la aserción no verificada entra en pánico y bloquea apko. Esto afecta a cualquier flujo de trabajo que inicializa la base de datos APK y obtiene las claves del repositorio. Este problema ha sido parcheado en la versión 1.2.7."
    }
  ],
  "lastModified": "2026-07-24T20:10:00.147",
  "sourceIdentifier": "security-advisories@github.com"
}