Quick answers
- Is CVE-2026-42575 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42575 being exploited in the wild.
- How severe is CVE-2026-42575?
- High severity, with a CVSS score of 7.5, published 9 May 2026.
- Which products and versions are affected?
- Chainguard Apko < 1.2.7; chainguard.dev/apko (Go) < 1.2.7, SEMVER:introduced=0,fixed=1.2.7.
- Is there a fix for CVE-2026-42575?
- Yes. chainguard.dev/apko (Go): upgrade to 1.2.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42575 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-42575?
- Check whether you run Chainguard Apko or chainguard.dev/apko (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- chainguard.dev/apko (Go): upgrade to 1.2.7 or later
go get chainguard.dev/apko@v1.2.7
Technical details
A vulnerability exists in apko's package retrieval logic within the getPackageImpl() function. While the tool correctly verifies the signature of the APKINDEX.tar.gz file, it fails to compare the computed hash of downloaded .apk files against the checksums defined in that signed index. An attacker capable of performing a Man-in-the-Middle (MitM) attack, poisoning a CDN cache, or compromising a package mirror can substitute legitimate packages with malicious ones. Because mismatched packages are silently accepted, the resulting OCI images will contain unverified and potentially malicious code. This issue is addressed in version 1.2.7.
Affected products
- Chainguard apko < 1.2.7
Identifiers
- CVE-2026-42575
- GHSA-hcwr-pq9g-rq3m
- GO-2026-5422
Timeline
- 2026-04-23: patched: Version 1.2.7 released
- 2026-05-09: disclosed: Initial advisory publication