The vulnerability in apko (versions before 1.2.7) involves insufficient verification of data authenticity (CWE-345). While the signature on the APKINDEX.tar.gz is verified, the checksums of individual .apk packages downloaded are not compared against the signed index's recorded checksums. The checksum values are parsed and available, and the package control hash is computed, but these are never compared in the getPackageImpl() function. This flaw allows an attacker capable of intercepting or substituting download responses (e.g., via a compromised mirror, HTTP repository, or poisoned CDN cache) to inject arbitrary packages into container images built by apko. The vulnerability is tracked as CVE-2026-42575 with a CVSS 3.1 score of 7.5 (high severity). The issue is patched in apko version 1.2.7.

An attacker who can manipulate the download source can cause apko to silently accept and install arbitrary, potentially malicious packages into OCI container images. This compromises the integrity of the built images, potentially leading to the inclusion of unauthorized or malicious software. There is no impact on confidentiality or availability indicated. No known exploits in the wild have been reported.

Upgrade apko to version 1.2.7 or later, where this vulnerability is patched. Prior versions do not properly verify package checksums against the signed index, allowing tampering. No other mitigation is indicated or required by the vendor advisory.