CVE-2026-54174

Received Received - Intake

Data Section Hash Bypass in Apko

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-54174

Affected Vendors & Products

Vendor	Product	Version / Range
melange	melange	to 0.50.4 (exc)
apko	apko	to 1.2.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-354	The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

Executive Summary

This vulnerability involves melange, a tool for building APK packages using declarative pipelines. The issue is that versions prior to 0.50.4 did not verify the data section hash of package files, only the control section hash. This allowed attackers to replace actual package files while the control hash check passed.

Detection Guidance

This vulnerability involves unchecked data section hashes in APK packages. To detect it, inspect APK files for mismatches between the control section hash and data section hash. Use apk verify --check <package.apk> to check integrity. Compare the output against known-good hashes from trusted sources.

Impact Analysis

If exploited, this vulnerability could allow attackers to substitute malicious files in packages you install. This could lead to compromised systems, unauthorized access, or data breaches if the packages contain sensitive or critical software.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. Organizations using affected versions may fail to meet integrity and security requirements for data protection.

Mitigation Strategies

Update melange to version 0.50.4 or later and apko to version 1.2.9 or later to address the missing data section hash verification.

Hi! I’m here to help you understand CVE-2026-54174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70