---
id: CVE-2026-42576
aliases:
  - GO-2026-5497
  - GHSA-m7hm-vm4x-28jf
title: >-
  apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during
  key discovery in chainguard.dev/apko
summary: >-
  apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during
  key discovery in chainguard.dev/apko
severity: none
vendor: apko
product: chainguard.dev/apko
ecosystem: go
affected:
  - chainguard.dev/apko < 1.2.7
patched:
  - chainguard.dev/apko 1.2.7
published: '2026-06-25'
updated: '2026-07-22'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5497'
references:
  - url: >-
      https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42576'
  - url: >-
      https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1
  - url: 'https://github.com/chainguard-dev/apko/releases/tag/v1.2.7'
tags:
  - osv
  - go
epss: 0.00252
epssPercentile: 0.16988
ingestedAt: '2026-07-23T19:05:54.140Z'
---

## Overview

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko

## Affected packages

- `chainguard.dev/apko < 1.2.7`

## Remediation

Upgrade to a patched release:

- `chainguard.dev/apko 1.2.7`