CVE-2026-105768: apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root
apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apkoto a version that resolves this vulnerability.Fixed in 1.4.5 - Operational
Rebuild images built with earlier apko versions from untrusted packages.
Event History
Frequently Asked Questions
Which environments are affected?
Apko versions 0.2.0 through before 1.4.5 are affected on 64-bit platforms. Exposure requires building an image that installs a package whose supplied passwd or group entries contain an out-of-range or negative UID or GID.
What level of package control does an attacker need?
The attacker must control a package that is installed into the apko-built image. They can provide an entry that appears unprivileged but is converted and written as UID 0 or GID 0.
What is the remediation?
Upgrade apko to version 1.4.5 or later. Version 1.4.5 contains the fix for the missing UID and GID range checks.