# CVE-2026-54174: Chainguard Melange and Apko incomplete package integrity verification

Source: https://junglewise.ai/threats/cve-2026-54174-chainguard-melange-and-apko-incomplete-package-integrity  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-54174 · Severity: high · CVSS 8.3 · Published 2026-09-11

A security flaw was found in the Melange and Apko tools, which are used to build and package secure software containers. The system failed to properly verify the integrity of the actual files being installed, checking only the package metadata. This could allow an attacker who controls a download mirror or intercepts network traffic to inject malicious files into your software builds, potentially compromising your production environment or customer data.

Technologies: [Chainguard Apko](https://junglewise.ai/threats/technologies/apko), [Chainguard Melange](https://junglewise.ai/threats/technologies/melange), [chainguard.dev/apko (Go)](https://junglewise.ai/threats/technologies/chainguard-dev-apko), [chainguard.dev/melange (Go)](https://junglewise.ai/threats/technologies/chainguard-dev-melange). Vendors: [Chainguard](https://junglewise.ai/threats/vendors/chainguard), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-54174 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54174 being exploited in the wild.

**How severe is CVE-2026-54174?** High severity, with a CVSS score of 8.3, published 11 September 2026.

**Which products and versions are affected?** Chainguard Apko < 1.2.9; Chainguard Melange < 0.50.4; chainguard.dev/apko (Go) < 1.2.9, SEMVER:introduced=0,fixed=1.2.9; chainguard.dev/melange (Go) < 0.50.4, SEMVER:introduced=0,fixed=0.50.4.

**Is there a fix for CVE-2026-54174?** Yes. chainguard.dev/apko (Go): upgrade to 1.2.9 or later; chainguard.dev/melange (Go): upgrade to 0.50.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54174 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54174?** Check whether you run Chainguard Apko, Chainguard Melange, chainguard.dev/apko (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- chainguard.dev/apko (Go): upgrade to 1.2.9 or later

  ```sh
  go get chainguard.dev/apko@v1.2.9
  ```

- chainguard.dev/melange (Go): upgrade to 0.50.4 or later

  ```sh
  go get chainguard.dev/melange@v0.50.4
  ```


## Technical details

The vulnerability stems from incomplete package integrity verification in Apko and Melange. While the tools verified the control section hash (e.g., .PKGINFO) against the signed APKINDEX, they failed to verify the data section hash containing the actual package files. An attacker with the ability to compromise a package mirror, poison a cache, or perform a Man-in-the-Middle (MITM) attack could substitute arbitrary file contents while the control hash check still passes. This is classified as CWE-345 (Insufficient Verification of Data Authenticity) and CWE-354 (Improper Validation of Integrity Check Value). Patches are available in Apko version 1.2.9 and Melange version 0.50.4.

## Affected products

- Chainguard apko < 1.2.9
- Chainguard melange < 0.50.4

## Identifiers

- CVE-2026-54174
- GHSA-fpg8-7664-jc5q
- GO-2026-5968

## Timeline

- 2026-06-03: disclosed: Initial disclosure to chainguard-dev/melange
- 2026-07-10: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/xnox](https://api.github.com/users/xnox)
- [https://github.com/xnox](https://github.com/xnox)
- [https://api.github.com/users/xnox/gists%7B/gist_id%7D](https://api.github.com/users/xnox/gists%7B/gist_id%7D)
- [https://api.github.com/users/xnox/repos](https://api.github.com/users/xnox/repos)
- [https://avatars.githubusercontent.com/u/19779?v=4](https://avatars.githubusercontent.com/u/19779?v=4)
- [https://api.github.com/users/xnox/events%7B/privacy%7D](https://api.github.com/users/xnox/events%7B/privacy%7D)

## Related threats

- [apko integer truncation in UID/GID parsing](https://junglewise.ai/threats/cve-2026-105768-apko-allows-users-to-build-and-publish-oci-container-images)
- [Chainguard apko denial of service via incorrect type assertion in DiscoverKeys](https://junglewise.ai/threats/cve-2026-42576-chainguard-apko-denial-of-service-via-incorrect-type-assertion-in)
- [Chainguard apko insufficient integrity check for apk packages](https://junglewise.ai/threats/cve-2026-42575-chainguard-apko-insufficient-integrity-check-for-apk-packages)
- [Chainguard apko path traversal via symlink following in DirFS](https://junglewise.ai/threats/cve-2026-42574-chainguard-apko-path-traversal-via-symlink-following-in-dirfs)
- [GO-2026-5562 - melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange](https://junglewise.ai/threats/cve-2026-29051-melange-has-path-traversal-via-pkginfo-in-persist-lint-results)