CVE-2026-105768: apko Privilege Escalation Vulnerability

CVE-2026-105768 Overview

CVE-2026-105768 affects apko, a tool from Chainguard that builds and publishes Open Container Initiative (OCI) container images from apk packages. The vulnerability stems from an integer truncation flaw [CWE-197] in UserEntry.Parse and GroupEntry.Parse within pkg/passwd. These functions read UID and GID fields from /etc/passwd and /etc/group, then convert them to uint32 without range checks. An attacker who controls a package installed into an image can declare a UID such as 4294967296 (2^32), which truncates to 0 on 64-bit platforms. The resulting image writes that entry as root, and the truncated UID is also used when resolving the image's run-as user.

Critical Impact
A malicious apk package can smuggle a root-mapped user or group entry into any image built with vulnerable apko versions, undermining the least-privilege guarantees expected from unprivileged runtime users.

Affected Products

chainguard-dev/apko version 0.2.0 through versions before 1.4.5
OCI container images built with vulnerable apko releases
Downstream pipelines consuming apko-produced images with untrusted apk sources

Discovery Timeline

2026-10-05 - CVE-2026-105768 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105768

Vulnerability Analysis

The flaw is a numeric truncation error in apko's passwd and group parsing logic. UserEntry.Parse and GroupEntry.Parse call strconv.Atoi to read UID and GID fields, which returns a platform-sized int. On 64-bit builds this comfortably holds values beyond the uint32 range. The parser then casts the result to uint32 with no bounds validation, discarding the upper bits.

Because apko reads entries supplied by installed packages and writes them back into the final image, any entry a package ships is trusted at parse time. The same truncated UID feeds the image's run-as user resolution. An attacker who controls a package therefore influences both the on-disk /etc/passwd identity and the runtime execution identity of the resulting container.

Root Cause

The root cause is unchecked conversion from int to uint32 after strconv.Atoi. Values of 2^32, 2^33, and similar multiples wrap to 0, which Linux treats as root. Negative values also wrap into high uint32 ranges with no diagnostic. The fix in v1.4.5 introduces explicit range validation using math boundaries before accepting the parsed identifier.

Attack Vector

Exploitation requires that an attacker-controlled apk package be included in an image build. The package ships a crafted passwd or group entry whose UID or GID is numerically out of range for uint32. When apko installs the package and rebuilds the image's identity files, the truncated value becomes 0, producing a user or group that is syntactically unprivileged but functionally root.

// Patch excerpt: pkg/apk/apk/install.go imports math for range checks
 	"fmt"
 	"io"
 	"io/fs"
+	"math"
 	"os"
 	"slices"
 	"strings"

Source: GitHub Commit 739e7ce

The fix also adds a reproducible tar fixture generator to validate parser behavior at the architectural boundary:

//go:build ignore

// Generates testdata/owner-width.tar, the fixture behind
// TestOwnerWidthBoundaries.
//
// Header.Uid is an int, and tar.Writer derives the uid/gid PAX records from
// that field, ignoring any the caller supplies in PAXRecords. Running it once
// on a 64-bit host and committing the bytes means the test reads what a real
// tar producer emits, on every architecture.
//
// An attacker is under no obligation to use archive/tar, so nothing here
// narrows the threat -- only the consumer's word size matters.
//
//	go run gen_owner_width_fixture.go
package main

import (
	"archive/tar"
	"fmt"
	"log"
	"os"
	"strconv"
)

Source: GitHub Commit 739e7ce

Detection Methods for CVE-2026-105768

Indicators of Compromise

/etc/passwd or /etc/group entries inside built images whose named account resolves to UID 0 or GID 0 despite not being root
Packages shipping passwd or group entries with UID/GID values at or above 4294967296 or with negative integers
Container runtime audit logs showing a non-root username executing with effective UID 0

Detection Strategies

Scan produced OCI image layers for duplicate UID 0 or GID 0 entries in /etc/passwd and /etc/group
Inspect apk package .pre-install and .post-install scripts, plus bundled passwd/group fragments, for out-of-range numeric identifiers
Fail builds in CI when apko version is less than 1.4.5 using the version string reported by apko version

Monitoring Recommendations

Monitor container registries for new images produced by pipelines still pinned to apko releases earlier than 1.4.5
Alert on runtime processes whose named user does not match the UID reported by the kernel
Track supply chain telemetry for new or modified apk packages introducing passwd or group manipulations

How to Mitigate CVE-2026-105768

Immediate Actions Required

Upgrade apko to version 1.4.5 or later across all build hosts and CI runners
Rebuild and redeploy any OCI images produced by vulnerable apko versions that consumed third-party apk repositories
Audit /etc/passwd and /etc/group in existing images for unexpected UID 0 or GID 0 mappings

Patch Information

The fix is included in apkov1.4.5 via Pull Request #2516 and commit 739e7ce. The patch adds math range validation before converting parsed identifiers to uint32. See the GitHub Security Advisory GHSA-rj6x-hwpv-vhvf for the full advisory.

Workarounds

Restrict apko builds to trusted apk repositories where package contents are reviewed before publication
Add a post-build verification step that rejects images containing non-root accounts resolving to UID 0 or GID 0
Pin container runtime --user flags to known good numeric UIDs rather than relying on image-declared usernames

bash

# Verify apko version meets the fixed release
apko version | awk '{print $NF}' | \
  xargs -I{} sh -c 'test "$(printf "1.4.5\n{}" | sort -V | head -n1)" = "1.4.5" && echo OK || echo UPGRADE'

# Audit a built image for stray root-mapped accounts
tar -xOf image.tar etc/passwd | awk -F: '$3==0 && $1!="root" {print "root-mapped user:",$0}'
tar -xOf image.tar etc/group  | awk -F: '$3==0 && $1!="root" {print "root-mapped group:",$0}'