Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-05 | 1 | General1 |
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 1 | General1 |
CVE-2026-42575 apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never … https://www.cve.org/CVERecord?id=CVE-2026-42575
Post summary
The text briefly mentions CVE‑2026‑42575 and notes a missing signature verification in apko before v1.2.7, but offers no detailed technical data, exploitation evidence, or remediation guidance.
CVE-2026-42575 Checksum Validation Bypass in apko Versions Prior to 1.2.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42575
Post summary
The text announces a vulnerability CVE-2026-42575, detailing a checksum validation bypass in apko versions prior to 1.2.7.
🔴 apko, Package Substitution, #CVE-2026-42575 (High) https://dailycve.com/apko-package-substitution-cve-2026-42575-high/
Post summary
The post announces CVE-2026-42575 with minimal detail and offers no evidence of exploitation, patches, or technical specifics.