CVE-2026-54174: chainguard-dev apko
Vulnerability summary
CVE-2026-54174 is a high (CVSS 8.3) vulnerability in chainguard-dev apko. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 11-09-2026PublishedVulnerability first disclosed.
- 14-09-2026Last modifiedVulnerability information updated.
Description
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- NVDNIST8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.15%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
+0.05 pp
From 0.10% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-354Improper Validation of Integrity Check ValueThe product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
Affected systems
Chainguard2 products
- cargobumpAll versions (No fix recorded)
- dagdotdev< 0.0.20-r22
Chainguard.dev2 products
- apko< 1.2.9
- melange< 0.50.4
Wolfi2 products
- cargobumpAll versions (No fix recorded)
- dagdotdev< 0.0.20-r22
Opensuse1 product
- apko&distro=openSUSE Tumbleweed< 1.4.4-1.1
5 vendors · 9 products
References
3 links- github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5qX Refsource CONFIRMWEBAdvisory