CVE-2026-54174

Apko (prior to 1.2.9, as bundled/used with melange prior to 0.50.4) verified only the control section hash of apk packages (e.g., .PKGINFO) against the signed APKINDEX, but never verified the data section hash covering the actual package files that get installed. An attacker positioned on the package fetch path — by compromising a mirror, poisoning a cache, or performing a man-in-the-middle attack — could substitute arbitrary file contents while the signature-based control hash check still passed. A successful attacker gains supply-chain compromise of build outputs: malicious files silently embedded into container images built with apko or packages built with melange. Anyone using vulnerable versions of these declarative build tools to produce apk-based images or packages is affected, particularly builds pulling from third-party mirrors or over untrusted networks. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation is not currently confirmed.

What to do: Upgrade apko to version 1.2.9 or later and melange to version 0.50.4 or later. Until patched, fetch packages only from trusted, TLS-protected official mirrors and purge any local/CI caches that could have been poisoned. Audit images and packages built with vulnerable versions for unexpected file contents, especially if third-party mirrors or untrusted networks were used.