Executive brief
apko is a tool used to build secure container images from APK packages. A vulnerability in how it handles security keys from remote repositories can cause the application to crash. If a user attempts to build an image using a repository that provides an unexpected key type, the build process will fail immediately, potentially disrupting automated software delivery pipelines.
Technical details
A panic occurs in the `DiscoverKeys` function within `pkg/apk/apk/implementation.go` due to an incorrect type conversion. The code unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without verifying the actual key type. If a remote repository's JWKS endpoint returns a non-RSA key (such as Elliptic Curve/EC), the unchecked assertion triggers a Go panic, crashing the apko process. This affects any workflow involving APK database initialization and key fetching. The issue is fixed in version 1.2.7 by implementing a guarded type assertion.
Affected products
- Chainguard apko < 1.2.7
Timeline
- 2026-04-23: patched: Version 1.2.7 released
- 2026-04-23: advisory: GitHub Security Advisory published
- 2026-05-09: disclosed: CVE-2026-42576 published to NVD