Chainguard

14 CVEs across 4 Chainguard products. Browse Chainguard vulnerabilities, severities, and proof-of-concept exploits.

Chainguard products with known CVEs

ProductCVEs
Melange7
Apko3
Malcontent3
Kaniko1
Chainguard CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-29051Medium4.42026-04-24melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-re…
CVE-2026-29050Medium6.12026-04-24melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a…
CVE-2026-29049Medium4.32026-03-06melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via…
CVE-2026-28407Medium5.32026-02-27malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would rem…
CVE-2026-28406High8.22026-02-27kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10…
CVE-2026-25145Medium5.52026-02-04melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configura…
CVE-2026-25143High7.82026-02-04melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch…
CVE-2026-24844High7.92026-02-04melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, bu…
CVE-2026-24843High8.22026-02-04melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a…
CVE-2026-25140High7.52026-02-04apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromis…
CVE-2026-25122Medium5.52026-02-04apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip…
CVE-2026-25121High7.52026-02-04apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was di…
CVE-2026-24846Medium5.52026-01-29malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcont…
CVE-2026-24845Medium6.52026-01-29malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcon…