Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-05 | 1 | Disclosure1 |
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 1 | Patch1 |
CVE-2026-42576 apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go uncondition… https://www.cve.org/CVERecord?id=CVE-2026-42576
Post summary
CVE‑2026‑42576 affects apko's DiscoverKeys function before version 1.2.7, and a patch is available in v1.2.7.
CVE-2026-42576 Denial of Service via Unchecked Type Assertion in apko Before 1.2.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42576 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A notification announcing a denial‑of‑service vulnerability (CVE-2026-42576) in apko before version 1.2.7, with links to vulnerability details but no evidence of exploitation or patch information.
🟠 apko, Panic on non-RSA JWKS key, #CVE-2026-42576 (Moderate) https://dailycve.com/apko-panic-on-non-rsa-jwks-key-cve-2026-42576-moderate/
Post summary
CVE-2026-42576 is a moderately severe vulnerability causing a panic when a non‑RSA JWKS key is used in apko; the announcement lacks PoC, exploit, patch, or active exploitation details.