CVE-2026-54174

HighCVSS 8.3/10Last modified Sep 30, 2026

Description

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-345CWE-354

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-541757.6backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-541766.5backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-541776.6backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-541788.1backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-541794.4backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-54187.3A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/apCVE-2026-541807.6backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-541815.4backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-541828.1backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build cCVE-2026-541834.3Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-deptCVE-2026-541848.2Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.CVE-2026-541858.5Subscriber SQL Injection in Cornerstone < 7.8.8 versions.
CVE-2026-54174: High severity, CVSS 8.3 | Vulnix