Medium severity · published May 9, 2026
CVE-2026-42576
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
apko · chainguard-dev
< 1.2.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42576
github.com
https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1
github.com
https://github.com/chainguard-dev/apko/releases/tag/v1.2.7
github.com
https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf
More from apko
8.3
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
7.5
CVE-2026-42575
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
7.5
CVE-2026-42574
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
7.5
CVE-2026-25140
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
7.5
CVE-2026-25121
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base