CVE-2026-105768 in apko
Summary
by MITRE • 10/06/2026
apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in apko, a tool designed for building and publishing OCI container images from apk packages, represents a critical security flaw rooted in improper input validation during identity parsing operations. Specifically affecting versions from 0.2.0 up to but not including 1.4.5, the defect resides within the UserEntry.Parse and GroupEntry.Parse functions located in the pkg/passwd module. These components are responsible for interpreting entries found in /etc/passwd and /etc/group files, which define user and group identities within a Linux environment. The core technical failure involves the use of strconv.Atoi to convert string representations of UID (User ID) and GID (Group ID) fields into uint32 integers without implementing any subsequent range checking or boundary validation logic. This oversight creates a significant discrepancy between how values are interpreted during parsing versus how they are ultimately applied within the container image context, particularly on 64-bit platforms where integer overflow behavior leads to unintended privilege escalation outcomes.
The operational mechanics of this vulnerability exploit standard arithmetic truncation rules inherent in Go's uint32 type when handling larger integers or negative numbers. When an out-of-range value such as 4294967296, which corresponds exactly to 2^32, is processed by strconv.Atoi and cast to a uint32, the result is truncated to zero due to overflow wrapping behavior. Similarly, negative values undergo sign extension issues that can also resolve to unexpected numeric results, potentially including zero or other privileged identifiers depending on specific bit patterns. Since apko parses these passwd and group entries supplied by installed packages and writes them directly into the final container image configuration, an attacker who maintains control over a package destined for installation within the target environment can craft malicious entry data. By specifying a UID or GID that appears unprivileged in its textual form but resolves to zero upon conversion, the attacker effectively forces the resulting container image to operate with root-level privileges despite appearing otherwise configured.
This flaw has profound implications for supply chain security and runtime isolation guarantees within containerized environments. The truncated UID is not only written into the static configuration of the image but also utilized when resolving the run-as user directive during execution. Consequently, containers launched from such images may execute processes as root even if the developer intended to enforce a non-privileged user context based on the apparent values in the package metadata. This undermines fundamental container security principles that rely on least privilege enforcement and can lead to full host compromise if combined with other vulnerabilities or misconfigurations. The issue aligns closely with CWE-190, which describes integer overflow or wraparound leading to unexpected behavior, as well as CWE-269 regarding improper privilege management where elevated privileges are granted unintentionally due to flawed logic in access control mechanisms.
From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Privilege Escalation via Container Escape or Misconfiguration, specifically falling under tactics that allow attackers to gain higher-level permissions within isolated environments. The attack vector typically involves manipulating package contents during build time rather than exploiting runtime flaws directly, highlighting risks in automated CI/CD pipelines where trust assumptions about third-party packages may be overly permissive. Mitigation strategies must prioritize immediate upgrade to version 1.4.5 or later, which implements proper range validation checks before casting UID and GID values. Additionally, organizations should enforce strict package signing policies and validate identity fields during image construction phases using static analysis tools capable of detecting integer conversion anomalies. Implementing defensive coding practices that explicitly verify numeric bounds against expected ranges for user identifiers is essential to prevent similar vulnerabilities in future software development cycles involving system account management logic.