chainguard-dev/apko · Security
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
- GHSA ID
- GHSA-m7hm-vm4x-28jf
- CVE ID
- CVE-2026-42576
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Description
DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. Affected versions <= 0.30.34.
Fix: No fix available yet.
Acknowledgements
apko thanks Oleh Konko from 1seal for discovering and reporting this issue.
CWEs
- CWE-704 · Incorrect Type Conversion or Cast
References
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-42576 ↗
- https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1 ↗
- https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 ↗
- https://github.com/advisories/GHSA-m7hm-vm4x-28jf ↗