What’s Vulnerable › Vulnerabilities

CVE-2024-36127: apko Exposure of HTTP basic auth credentials in log output

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-03 · updated 2026-06-17
• Weakness: CWE-522

Description

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.

Affected products

• chainguard-dev Apko: before 0.14.5 — fixed in 0.14.5

How to fix

Upgrade to a fixed version: chainguard-dev Apko 0.14.5. Check the vendor advisory for mitigations.

References

• https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp
• https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp

Get alerted when CVE-2024-36127 or the next vulnerability affects your stack