What’s Vulnerable › Products

chainguard-dev apko vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your chainguard-dev apko version is affected

Latest chainguard-dev apko vulnerabilities

• CVE-2026-105768 — apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root (CVSS 6.3)
• CVE-2026-54174 — melange: Incomplete package integrity verification allows data section substitution (CVSS 8.3)
• CVE-2026-42576 — apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery (CVSS 6.5)
• CVE-2026-42575 — apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) (CVSS 7.5)
• CVE-2026-42574 — apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root (CVSS 7.5)
• CVE-2026-25140 — apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams (CVSS 7.5)
• CVE-2026-25122 — apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams (CVSS 5.5)
• CVE-2026-25121 — apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base (CVSS 7.5)
• CVE-2025-53945 — apko has incorrect permission (0666) in /etc/ld.so.cache and other files (CVSS 7.0)