Executive brief
A security flaw was found in the Melange and Apko tools, which are used to build and package secure software containers. The system failed to properly verify the integrity of the actual files being installed, checking only the package metadata. This could allow an attacker who controls a download mirror or intercepts network traffic to inject malicious files into your software builds, potentially compromising your production environment or customer data.
Technical details
The vulnerability stems from incomplete package integrity verification in Apko and Melange. While the tools verified the control section hash (e.g., .PKGINFO) against the signed APKINDEX, they failed to verify the data section hash containing the actual package files. An attacker with the ability to compromise a package mirror, poison a cache, or perform a Man-in-the-Middle (MITM) attack could substitute arbitrary file contents while the control hash check still passes. This is classified as CWE-345 (Insufficient Verification of Data Authenticity) and CWE-354 (Improper Validation of Integrity Check Value). Patches are available in Apko version 1.2.9 and Melange version 0.50.4.
Affected products
- Chainguard apko < 1.2.9
- Chainguard melange < 0.50.4
Timeline
- 2026-06-03: disclosed: Initial disclosure to chainguard-dev/melange
- 2026-07-10: advisory: GitHub Advisory published