Junglewise Threat Intelligence

CVE-2026-42576: Chainguard apko denial of service via incorrect type assertion in DiscoverKeys

CVE-2026-42576 · Severity: medium · CVSS 6.5 · Published 2026-05-09

Technologies: Chainguard Apko, chainguard.dev/apko (Go). Vendors: Chainguard, Go.

Executive brief

apko is a tool used to build secure container images from APK packages. A vulnerability in how it handles security keys from remote repositories can cause the application to crash. If a user attempts to build an image using a repository that provides an unexpected key type, the build process will fail immediately, potentially disrupting automated software delivery pipelines.

Technical details

A panic occurs in the `DiscoverKeys` function within `pkg/apk/apk/implementation.go` due to an incorrect type conversion. The code unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without verifying the actual key type. If a remote repository's JWKS endpoint returns a non-RSA key (such as Elliptic Curve/EC), the unchecked assertion triggers a Go panic, crashing the apko process. This affects any workflow involving APK database initialization and key fetching. The issue is fixed in version 1.2.7 by implementing a guarded type assertion.

Affected products

  • Chainguard apko < 1.2.7

Timeline

  • 2026-04-23: patched: Version 1.2.7 released
  • 2026-04-23: advisory: GitHub Security Advisory published
  • 2026-05-09: disclosed: CVE-2026-42576 published to NVD

References

Related threats