Description
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf
X_Refsource_Misc x_refsource_misc
https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1
X_Refsource_Misc x_refsource_misc
https://github.com/chainguard-dev/apko/releases/tag/v1.2.7
Scores
CVSS v3
6.5
EPSS
0.0025
EPSS Percentile
16.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-704
Status
published
Products (2)
chainguard-dev/apko
< 1.2.7
chainguard.dev/apko
0 - 1.2.7Go
Published
May 09, 2026
Tracked Since
May 10, 2026