The vulnerability arises from an incorrect type conversion (CWE-704) in the DiscoverKeys function within apko's pkg/apk/apk/implementation.go. The function unconditionally asserts JWKS keys as *rsa.PublicKey without checking if the key is actually RSA. When a JWKS endpoint returns a non-RSA key type, such as an elliptic curve key, the unchecked type assertion causes a runtime panic, crashing the apko process. This affects any operation that initializes the APK database and fetches repository keys, leading to denial of service. The issue is resolved in apko version 1.2.7.

The vulnerability does not lead to confidentiality or integrity loss but causes a denial of service by crashing apko when it encounters non-RSA JWKS keys. This disrupts workflows that rely on apko for building and publishing OCI container images from apk packages. There are no known exploits in the wild. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability.

A fix for this vulnerability is available in apko version 1.2.7. Users should upgrade to version 1.2.7 or later to prevent crashes caused by non-RSA JWKS keys. No other mitigations are indicated or required.