chainguard-dev/apko Security Advisories | GitStock

high2026-05-04

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

GHSA-hcwr-pq9g-rq3m · CVE-2026-42575

high2026-05-04

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

GHSA-qq3r-w4hj-gjp6 · CVE-2026-42574

medium2026-05-04

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

GHSA-m7hm-vm4x-28jf · CVE-2026-42576

high2026-02-04

apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

GHSA-f4w5-5xv9-85f6 · CVE-2026-25140

medium2026-02-03

apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

GHSA-6p9p-q6wh-9j89 · CVE-2026-25122

high2026-02-03

apko has a path traversal in apko dirFS which allows filesystem writes outside base

GHSA-5g94-c2wx-8pxw · CVE-2026-25121

high2025-07-18

apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

GHSA-x6ph-r535-3vjw · CVE-2025-53945

high2024-06-04

apko Exposure of HTTP basic auth credentials in log output

GHSA-v6mg-7f7p-qmqp · CVE-2024-36127