CVE-2026-24843: Chainguard Melange Path Traversal Flaw

CVE-2026-24843 Overview

CVE-2026-24843 is a path traversal vulnerability [CWE-22] in Chainguard melange, an open-source tool that builds Alpine Package Keeper (apk) packages using declarative pipelines. The flaw resides in the retrieveWorkspace function, which extracts tar entries from a QEMU guest VM without validating that target paths remain inside the workspace directory. An attacker able to influence the tar stream from a guest VM can write files outside the intended workspace on the host using ../ sequences. Affected versions span 0.11.3 up to but not including 0.40.3. The issue is patched in version 0.40.3.

Critical Impact
A local attacker with low privileges who controls the tar stream from a QEMU guest can write arbitrary files on the host, breaking the guest-to-host isolation boundary and enabling integrity and availability compromise across the build host.

Affected Products

Chainguard melange versions 0.11.3 through 0.40.2
Build environments using melange with QEMU guest VMs
CI/CD pipelines producing apk packages with vulnerable melange releases

Discovery Timeline

2026-02-04 - CVE-2026-24843 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-24843

Vulnerability Analysis

The vulnerability resides in melange's retrieveWorkspace function inside pkg/build/build.go. The function reads a tar archive produced inside a QEMU guest VM and extracts entries to a workspace directory on the host. Before the patch, the extraction logic did not validate that resolved entry paths remained within the workspace base directory. A tar entry containing ../ traversal sequences, or an absolute path, was written to the host filesystem at the attacker-controlled location.

Because the QEMU guest is treated as an untrusted producer of build artifacts, any influence over the tar stream — including malicious build scripts, compromised source dependencies, or a hostile package definition — is sufficient to trigger the flaw. The scope-changed CVSS vector reflects that exploitation crosses the trust boundary from the guest VM into the host build environment.

Root Cause

The root cause is missing path canonicalization and containment checks during tar extraction. The extractor concatenated the tar header Name field with the workspace base path and called the file write directly, without computing a cleaned relative path and confirming it stayed under the base directory. Null bytes and absolute paths were also not rejected.

Attack Vector

An attacker who can influence the contents of the tar stream returned from the QEMU guest — for example, by controlling the package build definition or a build-time dependency — crafts a tar entry whose name contains ../ sequences or an absolute path. When melange extracts the archive on the host, the entry is written outside the workspace directory, potentially overwriting CI configuration, SSH keys, or binaries executed by subsequent build stages.

// Patch: pkg/build/build.go - isValidPath enforces workspace containment
// isValidPath validates that a tar entry path doesn't escape the workspace directory.
// This prevents path traversal attacks via malicious tar archives.
// Based on validation logic from github.com/chainguard-dev/malcontent/pkg/archive
func isValidPath(targetPath, baseDir string) error {
	// Check for null bytes
	if strings.Contains(targetPath, "\\x00") || strings.Contains(baseDir, "\\x00") {
		return fmt.Errorf("path contains null byte")
	}

	// Clean and normalize paths
	cleanTarget := filepath.Clean(targetPath)
	cleanBase := filepath.Clean(baseDir)

	// Reject absolute paths
	if filepath.IsAbs(cleanTarget) {
		return fmt.Errorf("absolute paths not allowed: %s", targetPath)
	}

	// Build the full target path
	fullTarget := filepath.Join(cleanBase, cleanTarget)

	// Check that the path is within the base directory
	relPath, err := filepath.Rel(cleanBase, fullTarget)
	if err != nil {
		return fmt.Errorf("invalid path: %w", err)
	}

Source: Chainguard melange commit 6e243d0

Detection Methods for CVE-2026-24843

Indicators of Compromise

Files created or modified on the build host outside the melange workspace directory during or after a build, particularly in $HOME, /etc, /root/.ssh, or CI runner working directories.
Tar archives transferred from QEMU guests containing entries with ../ sequences, absolute paths, or null bytes in entry names.
melange build logs referencing unexpected write targets when retrieveWorkspace executes.

Detection Strategies

Inventory all CI/CD hosts and developer workstations running melange and flag any version between 0.11.3 and 0.40.2.
Audit tar archives produced by QEMU guests offline using a path-traversal-aware extractor or static inspection of entry names.
Enable filesystem auditing (auditd, eBPF) on build hosts to record writes performed by the melange process outside its workspace path.

Monitoring Recommendations

Alert on file writes by melange to paths not prefixed by the configured workspace directory.
Track creation or modification of SSH keys, shell rc files, and CI configuration files on build hosts during package builds.
Monitor outbound activity from build hosts immediately following melange runs for signs of post-exploitation persistence.

How to Mitigate CVE-2026-24843

Immediate Actions Required

Upgrade melange to version 0.40.3 or later on every build host and CI runner.
Rebuild any apk packages produced by vulnerable melange versions after verifying the integrity of the build host.
Rotate credentials, SSH keys, and tokens stored on build hosts that ran untrusted build definitions with vulnerable melange releases.

Patch Information

The fix is in melange version 0.40.3. The patch adds the isValidPath helper and invokes it during tar extraction in retrieveWorkspace, rejecting null bytes, absolute paths, and any entry that resolves outside the workspace base directory. See the GitHub Security Advisory GHSA-qxx2-7h4c-83f4 and the upstream patch commit for details.

Workarounds

Restrict melange builds to trusted package definitions and dependency sources until the upgrade is applied.
Run melange inside an ephemeral, unprivileged container or VM with no access to host secrets or persistent storage outside the workspace.
Apply mandatory access controls (SELinux, AppArmor) that confine melange writes to the designated workspace directory.

bash

# Verify installed melange version and upgrade
melange version

# Go install (example)
go install chainguard.dev/melange@v0.40.3

# Confirm the fixed version is in use
melange version | grep -E "0\.(40\.[3-9]|[4-9][0-9])"