~ / search / GHSA-m7hm-vm4x-28jf

GHSA-m7hm-vm4x-28jf

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-42576

Packages

EcosystemPackageAffectedFixed in
Go chainguard.dev/apko < 1.2.7 1.2.7

Details

As written in the advisory (Markdown source, shown as plain text).

`DiscoverKeys` in `pkg/apk/apk/implementation.go` unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. Affected versions <= 0.30.34. **Fix:** No fix available yet. **Acknowledgements** apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.

References

External links from the advisory. They lead to third-party sites.