apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
chainguard-dev apko affected
Version Status Constraints
< 1.2.7 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-m7hm-vm4x-28jf apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1 cve-icon
https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 cve-icon
https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf cve-icon
History

Sat, 09 May 2026 19:45:00 +0000

Type Values Removed Values Added
Description apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.
Title apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Weaknesses CWE-704
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-09T19:26:56.224Z

Reserved: 2026-04-28T17:26:12.085Z

Link: CVE-2026-42576

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses