Description

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-11T21:17:11.403Z",
  "pubdate": "2026-09-11T21:17:11.403Z",
  "executiveSummary": "This vulnerability involves a failure in the integrity verification process within the apko and melange build systems. Specifically, the software verified the control section of APK packages against signed indices but neglected to validate the cryptographic hash of the data section containing the actual file contents.\nThe flaw affects apko versions prior to 1.2.9 and melange versions prior to 0.50.4. By failing to verify the data integrity, the system is susceptible to unauthorized package modification.\nAn attacker capable of performing a Man-in-the-Middle (MITM) attack, compromising a package mirror, or poisoning a distribution cache can inject malicious payloads into packages without triggering security alerts.\nThe risk implication is significant, as compromised packages can lead to arbitrary code execution on systems installing or using the affected APKs. Exploitation does not require authentication or elevated privileges from the victim, but it relies on the attacker's ability to manipulate the delivery channel of the package files.",
  "technicalDetails": "The vulnerability resides in the APK package ingestion and verification logic of apko and melange. APK packages are structured to include a control section (containing metadata such as .PKGINFO) and a data section (containing the actual file system artifacts).\nRoot Cause: The security implementation was scoped incorrectly, verifying the hash of the control section metadata against the signed APKINDEX while omitting the checksum validation for the compressed data archive. Consequently, the signature verification process only confirmed the authenticity of the package metadata, leaving the actual file contents vulnerable to tampering.\nExploitation Flow: An attacker can intercept the network communication during the fetch process or gain unauthorized access to a repository mirror. The attacker replaces the original data archive of an APK with a malicious version containing backdoors or modified binaries. Because the control section remains original and matches the APKINDEX, the signature check remains valid.\nUpon installation or build time, apko/melange confirms the control section signature, assumes the integrity of the entire package, and proceeds to extract the malicious payload. This bypasses the security controls designed to ensure that the installed software matches the verified upstream source.\nImpact: This vulnerability facilitates a supply chain attack vector. Since the integrity of the files is not cryptographically bound to the signed APKINDEX, the system cannot detect discrepancies between the intended package and the injected malicious package. This leads to persistent, unauthorized code execution or system compromise once the modified package is deployed in target environments.\nAffected Versions: apko versions prior to 1.2.9 and melange versions prior to 0.50.4 are affected. The attack does not require specific user authentication or privilege escalation, as the vulnerability is inherent in the automated package handling process, making it a passive-to-active exploit depending on the attacker's positioning in the delivery chain."
}