Vulnerability · Published May 9, 2026 · Assigned by GitHub_M
CVE-2026-42576apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Medium 6.5
In plain English
A medium-severity security flaw in apko from chainguard-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | chainguard.dev/apko | 1.2.7 | GHSA-m7hm-vm4x-28jf |
| Go | chainguard.dev/apko | 1.2.7 | GO-2026-5497 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chainguard-dev | apko | < 1.2.7 |
Weakness: CWE-704 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H