CVE-2026-54174: Melange APK Package Data Verification Bypass

CVE-2026-54174 Overview

CVE-2026-54174 affects apko and melange, tools from Chainguard used to build APK packages through declarative pipelines. The vulnerability stems from incomplete integrity verification of downloaded APK packages. Both tools verified the control section hash against the signed APKINDEX but never verified the data section hash containing the actual installable files. An attacker who compromises a mirror, poisons a cache, or performs a machine-in-the-middle (MITM) attack on a package fetch can substitute arbitrary file contents while the control hash check still succeeds. The flaw is tracked as [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Successful exploitation allows attackers to inject arbitrary file contents into built container images and packages, enabling supply chain compromise of downstream artifacts.

Affected Products

Chainguard apko prior to version 1.2.9
Chainguard melange prior to version 0.50.4
Downstream container images and APK packages built with vulnerable versions

Discovery Timeline

2026-09-11 - CVE-2026-54174 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54174

Vulnerability Analysis

APK packages contain two primary sections: a control section holding metadata such as .PKGINFO, and a data section holding the files installed on the target system. The APKINDEX file, cryptographically signed by the repository, lists hashes for both sections. Correct verification requires validating both hashes against the signed index.

In vulnerable versions of apko and melange, only the control section hash was verified. The data section hash was ignored during fetch and install operations. As a result, the signed APKINDEX provided integrity guarantees for package metadata but not for the actual files delivered to the build.

This breaks the trust model that APK signing is designed to enforce. Any position in the supply chain able to modify a package payload — a mirror operator, a caching proxy, or a network attacker — can substitute the data section without detection. Because apko and melange are commonly used to construct container base images, the injected content propagates to every image built from the compromised package.

Root Cause

The root cause is missing verification logic. The code paths that validated hashes referenced from the signed APKINDEX compared only the control section digest. No corresponding comparison was performed for the data section digest, leaving package payloads unauthenticated even when signature verification appeared to succeed.

Attack Vector

Exploitation requires an attacker positioned to alter APK content in transit or at rest on a mirror or cache. The attacker leaves the control section and its hash intact, then modifies the data section to include arbitrary files. When a build client fetches the package, control hash verification passes and the malicious data section is installed without warning. See the GitHub Security Advisory GHSA-fpg8-7664-jc5q for technical details.

Detection Methods for CVE-2026-54174

Indicators of Compromise

Unexpected files, binaries, or configuration changes in container images produced by apko or melange builds
APK packages whose data section contents do not match the hash recorded in the signed APKINDEX
Build logs referencing package fetches from untrusted or unexpected mirror hosts

Detection Strategies

Re-verify all APK packages installed by recent apko and melange builds by comparing data section hashes against the signed APKINDEX
Perform differential analysis between images built before and after upgrading to patched versions to identify anomalous payloads
Inventory build pipelines to identify hosts running vulnerable apko or melange versions

Monitoring Recommendations

Log and alert on APK fetches that traverse non-canonical mirrors or transparent proxies
Monitor CI/CD systems for unexpected changes to build tool versions and pinned dependencies
Track network egress from build workers to detect MITM positioning against package repositories

How to Mitigate CVE-2026-54174

Immediate Actions Required

Upgrade apko to version 1.2.9 or later and melange to version 0.50.4 or later
Rebuild any container images or APK artifacts produced by vulnerable versions after upgrading
Audit package mirrors and caching infrastructure used by build pipelines for signs of tampering

Patch Information

Chainguard released fixes in apko version 1.2.9 and melange version 0.50.4. These releases add verification of the data section hash against the signed APKINDEX, closing the gap that allowed payload substitution. Full details are documented in the GitHub Security Advisory GHSA-fpg8-7664-jc5q.

Workarounds

Restrict apko and melange builds to trusted, TLS-protected package repositories under direct control
Disable or bypass intermediate caching proxies for APK fetches until patched versions are deployed
Pin package versions and independently verify data section hashes out of band before promoting build outputs

bash

# Upgrade to patched versions
go install chainguard.dev/apko@v1.2.9
go install chainguard.dev/melange@v0.50.4

# Verify installed versions
apko version
melange version