GHSA-m7hm-vm4x-28jf

    Dashboard / Vulnerabilities / GHSA-m7hm-vm4x-28jf

    GHSA-m7hm-vm4x-28jf

    Published: 4 May 2026Last Modified: 10 Sept 2026

    Summary: apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

    Details: `DiscoverKeys` in `pkg/apk/apk/implementation.go` unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. Affected versions <= 0.30.34. **Fix:** No fix available yet. **Acknowledgements** apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.

    References: https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf, https://nvd.nist.gov/vuln/detail/CVE-2026-42576, https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1, https://github.com/chainguard-dev/apko, https://github.com/chainguard-dev/apko/releases/tag/v1.2.7

    Affected packages

    Package

    Name: chainguard.dev/apko

    Purl: pkg:golang/chainguard.dev/apko

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.2.7

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-m7hm-vm4x-28jf | CVE-DB