---
id: CVE-2026-42575
aliases:
  - GO-2026-5422
  - GHSA-hcwr-pq9g-rq3m
title: >-
  apko doesn't verify downloaded apk packages against APKINDEX checksum (package
  substitution possible) in chainguard.dev/apko
summary: >-
  apko doesn't verify downloaded apk packages against APKINDEX checksum (package
  substitution possible) in chainguard.dev/apko
severity: none
vendor: apko
product: chainguard.dev/apko
ecosystem: go
affected:
  - chainguard.dev/apko < 1.2.7
patched:
  - chainguard.dev/apko 1.2.7
published: '2026-06-25'
updated: '2026-07-22'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5422'
references:
  - url: >-
      https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42575'
  - url: >-
      https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa
  - url: 'https://github.com/chainguard-dev/apko/releases/tag/v1.2.7'
tags:
  - osv
  - go
epss: 0.00159
epssPercentile: 0.05474
ingestedAt: '2026-07-23T19:05:54.117Z'
---

## Overview

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko

## Affected packages

- `chainguard.dev/apko < 1.2.7`

## Remediation

Upgrade to a patched release:

- `chainguard.dev/apko 1.2.7`