CVE-2026-54174

melange: Incomplete package integrity verification allows data section substitution

State: Published
Severity: 8.3 High
Published: Sep 11, 2026
Updated: Sep 14, 2026
Reserved: Jun 11, 2026

Description

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-354 Improper Validation of Integrity Check Value
CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
melangechainguard-dev	< 0.50.4Affected
apkochainguard-dev	< 1.2.9Affected

References

https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.