EUVD-2026-161079

fkie_cve-2024-36127

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.

GHSA-v6mg-7f7p-qmqp — apko Exposure of HTTP basic auth credentials in log output

Affected: Go: chainguard.dev/apko

### Summary

Exposure of HTTP basic auth credentials from repository and keyring URLs in log output

### Details

There was a handful of instances where the `apko` tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons:

1. The`%s` verb was used to format a `url.URL` as a string, which includes un-redacted HTTP basic authentication credentials if they are included in the URL. 2. A string URL value (such as from the configuration YAML file supplied used in an apko execution) was never parsed as a URL, so there was no chance of redacting credentials in the logical flow.

apko, as well as its companion library `go-apk`, have been updated to ensure URLs are parsed and redacted before being output as string values.

### PoC

Create a config file like this `apko.yaml`:

```yaml contents: keyring: - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub repositories: - https://me%40example.com:supersecretpassword@localhost:8080/os packages: - wolfi-base

cmd: /bin/sh -l

archs: - x86_64 - aarch64 ```

Then run:

```shell apko build apko.yaml latest foo.tar --log-level debug ```

Observe instances of the password being shown verbatim in the log output, such as:

```text ... DEBU image configuration: contents: repositories: - https://me%40example.com:supersecretpassword@localhost:8080/os keyring: - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub packages:…

Most recent entries from all

EUVD-2026-161079

fkie_cve-2024-36127

GHSA-v6mg-7f7p-qmqp — apko Exposure of HTTP basic auth credentials in log output