Is CVE-2026-54174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54174 being exploited in the wild.

How severe is CVE-2026-54174?

High severity, with a CVSS score of 8.3, published 11 September 2026.

Which products and versions are affected?

Chainguard Apko < 1.2.9; Chainguard Melange < 0.50.4; chainguard.dev/apko (Go) < 1.2.9, SEMVER:introduced=0,fixed=1.2.9; chainguard.dev/melange (Go) < 0.50.4, SEMVER:introduced=0,fixed=0.50.4.

Is there a fix for CVE-2026-54174?

Yes. chainguard.dev/apko (Go): upgrade to 1.2.9 or later; chainguard.dev/melange (Go): upgrade to 0.50.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54174 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54174?

Check whether you run Chainguard Apko, Chainguard Melange, chainguard.dev/apko (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54174: Chainguard Melange and Apko incomplete package integrity verification

Q: Which products and versions are affected?

Chainguard Apko < 1.2.9; Chainguard Melange < 0.50.4; chainguard.dev/apko (Go) < 1.2.9, SEMVER:introduced=0,fixed=1.2.9; chainguard.dev/melange (Go) < 0.50.4, SEMVER:introduced=0,fixed=0.50.4.

Q: Is there a fix for CVE-2026-54174?

Yes. chainguard.dev/apko (Go): upgrade to 1.2.9 or later; chainguard.dev/melange (Go): upgrade to 0.50.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54174 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54174?

Check whether you run Chainguard Apko, Chainguard Melange, chainguard.dev/apko (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54174 · Severity: high · CVSS 8.3 · Published 2026-09-11

A security flaw was found in the Melange and Apko tools, which are used to build and package secure software containers. The system failed to properly verify the integrity of the actual files being installed, checking only the package metadata. This could allow an attacker who controls a download mirror or intercepts network traffic to inject malicious files into your software builds, potentially compromising your production environment or customer data.

Technologies: Chainguard Apko, Chainguard Melange, chainguard.dev/apko (Go), chainguard.dev/melange (Go). Vendors: Chainguard, Go.

Quick answers

Is CVE-2026-54174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54174 being exploited in the wild.
How severe is CVE-2026-54174?: High severity, with a CVSS score of 8.3, published 11 September 2026.
Which products and versions are affected?: Chainguard Apko < 1.2.9; Chainguard Melange < 0.50.4; chainguard.dev/apko (Go) < 1.2.9, SEMVER:introduced=0,fixed=1.2.9; chainguard.dev/melange (Go) < 0.50.4, SEMVER:introduced=0,fixed=0.50.4.
Is there a fix for CVE-2026-54174?: Yes. chainguard.dev/apko (Go): upgrade to 1.2.9 or later; chainguard.dev/melange (Go): upgrade to 0.50.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54174 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54174?: Check whether you run Chainguard Apko, Chainguard Melange, chainguard.dev/apko (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

chainguard.dev/apko (Go): upgrade to 1.2.9 or later
```
go get chainguard.dev/apko@v1.2.9
```
chainguard.dev/melange (Go): upgrade to 0.50.4 or later
```
go get chainguard.dev/melange@v0.50.4
```

Technical details

The vulnerability stems from incomplete package integrity verification in Apko and Melange. While the tools verified the control section hash (e.g., .PKGINFO) against the signed APKINDEX, they failed to verify the data section hash containing the actual package files. An attacker with the ability to compromise a package mirror, poison a cache, or perform a Man-in-the-Middle (MITM) attack could substitute arbitrary file contents while the control hash check still passes. This is classified as CWE-345 (Insufficient Verification of Data Authenticity) and CWE-354 (Improper Validation of Integrity Check Value). Patches are available in Apko version 1.2.9 and Melange version 0.50.4.

Affected products

Chainguard apko < 1.2.9
Chainguard melange < 0.50.4

Identifiers

CVE-2026-54174
GHSA-fpg8-7664-jc5q
GO-2026-5968

Timeline

2026-06-03: disclosed: Initial disclosure to chainguard-dev/melange
2026-07-10: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.