Login Request a demo
High severity · published Sep 11, 2026
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
8.3
CVSS
0.2%
EPSS
No
On KEV
Description
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
apko · chainguard-dev
< 1.2.9 · source: vendor
ME
melange · chainguard-dev
< 0.50.4 · source: vendor
Affected product
AP
apko
chainguard-dev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54174
github.com
https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q
More from apko
7.5
CVE-2026-42575
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
7.5
CVE-2026-42574
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
7.5
CVE-2026-25140
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
7.5
CVE-2026-25121
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
7.0
CVE-2025-53945
apko has incorrect permission (0666) in /etc/ld.so.cache and other files