The vulnerability in Apko (chainguard.dev/apko) arises from incomplete package integrity verification. While the control section hash (such as .PKGINFO) was verified against the signed APKINDEX, the data section hash, which covers the actual files installed by the package, was not verified. This gap allows an attacker with the ability to compromise a package mirror, cache, or intercept package fetches to substitute arbitrary file contents without detection, as the control hash verification still passes. This issue affects versions prior to 1.2.9 and 0.50.4. The CVSS 3.1 vector indicates network attack complexity is high, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

An attacker capable of compromising a package mirror, poisoning a cache, or performing a man-in-the-middle attack can substitute arbitrary files in the package data section without detection. This can lead to full compromise of confidentiality, integrity, and availability of the system installing the package, as malicious or altered files may be installed despite passing control section hash verification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions and obtain packages only from trusted, verified sources. Monitoring for updates from the vendor is recommended to apply any forthcoming patches addressing this vulnerability.