Is CVE-2026-42575 actively exploited?

No active exploitation of CVE-2026-42575 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42575 be exploited remotely?

Yes. CVE-2026-42575 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-42575?

CVE-2026-42575 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-42575

HIGH

CVE-2026-42575

CWE-345Published: May 9, 2026· Updated: May 13, 2026

7.5

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.6th

Official Description

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.

NVD Source

Technical Analysis

CVE-2026-42575 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.