Quick answers
- Is CVE-2026-105768 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105768 being exploited in the wild.
- How severe is CVE-2026-105768?
- Informational severity, published 5 October 2026.
- Which products and versions are affected?
- Chainguard Apko 0.2.0 to before 1.4.5.
- Is there a fix for CVE-2026-105768?
- Yes: fixed in apko 1.4.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-105768 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-105768?
- Check whether you run Chainguard Apko at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: apko 1.4.5
Technical details
UserEntry.Parse and GroupEntry.Parse in pkg/passwd use strconv.Atoi to read UID/GID fields and convert to uint32 without range checking. On 64-bit systems, out-of-range values like 4294967296 (2^32) truncate to 0, and negative values wrap around. An attacker controlling a package can supply a malicious /etc/passwd or /etc/group entry that appears to declare an unprivileged UID or GID but is written into the image as UID 0 or GID 0 (root), and this truncated UID is used when resolving the image's run-as user.
Affected products
- Chainguard apko 0.2.0 to before 1.4.5
Timeline
- 2026-10-05: disclosed
- 2026-09-21: patched