SEPTEMBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-54174

HIGH · CVSS 8.3 EPSS 0.10% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-13

CyberRota Analysis

AI-Generated

The vulnerability affects the Apko package manager prior to version 1.2.9 and Melange prior to version 0.50.4, allowing attackers to substitute arbitrary file contents during package installation without triggering a control hash verification failure. This could lead to the installation of malicious packages if an attacker compromises a mirror, poisons a cache, or conducts a man-in-the-middle attack. Organizations using these tools should prioritize updates to mitigate the risk of unauthorized code execution and potential system compromise.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-54174
Severity
HIGH
CVSS
8.3
EPSS
0.10%

Original NVD Description

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.