CVE-2026-105768

Description

apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5.

Is your site exposed to CVE-2026-105768?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-197 CWE-197

References

Other References

https://github.com/chainguard-dev/apko/commit/739e7ce3f675ffb232e16849b51ff93657f1570c https://github.com/chainguard-dev/apko/pull/2516 https://github.com/chainguard-dev/apko/releases/tag/v1.4.5 https://github.com/chainguard-dev/apko/security/advisories/GHSA-rj6x-hwpv-vhvf

Frequently Asked Questions

What is CVE-2026-105768? +

apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5.

How do I check if I'm vulnerable to CVE-2026-105768? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-6039

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a …

CVE-2026-76151

Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 …

CVE-2026-65610

nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence …

CVE-2024-43639 9.8

Windows KDC Proxy Remote Code Execution Vulnerability

CVE-2025-6965 9.8

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of …

CVE-2026-87529 9.6

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code …