CVE-2026-42576
MEDIUM6.5EPSS 0.03%apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Published: 5/4/2026Modified: 5/13/2026
Description
`DiscoverKeys` in `pkg/apk/apk/implementation.go` unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. Affected versions <= 0.30.34. **Fix:** No fix available yet. **Acknowledgements** apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
Affected packages (1)
- Go/chainguard.dev/apkofrom 0, < 1.2.7
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
References (5)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-42576
- PATCHhttps://github.com/chainguard-dev/apko
- WEBhttps://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1
- WEBhttps://github.com/chainguard-dev/apko/releases/tag/v1.2.7
- WEBhttps://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf