CVE-2026-54174: melange: Incomplete package integrity verification allows data section substitution

July 10, 2026

Previously, Apko verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

References

github.com/advisories/GHSA-fpg8-7664-jc5q
github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q
nvd.nist.gov/vuln/detail/CVE-2026-54174

Code Behaviors & Features

Detect and mitigate CVE-2026-54174 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →