DiscoverKeys in apko unconditionally type‑asserts JWKS keys as RSA public keys without verifying the key type. If a repository JWKS endpoint supplies a non‑RSA key such as EC, the assertion fails, causing a panic and crashing apko. The crash occurs during initialization of the APK database and repository key fetching, leading to a denial of service for any process that uses apko. The weakness is classified as CWE‑704.

Vendors: chainguard‑dev. Product: apko. Affected versions: any release prior to v1.2.7. The critical failure occurs in the DiscoverKeys component, which is used during image build and publication workflows that rely on APK package repositories.

The vulnerability has a CVSS score of 6.5, indicating a moderate severity. No EPSS score is reported, so the likelihood of exploitation is not quantified, and vulnerability is not listed in CISA KEV. Because the failure happens during repository key discovery, an attacker would need to control or manipulate a repository or hijack a JWKS endpoint to supply a non‑RSA key. If successful, the attacker can cause apko to crash, resulting in interruption of image build or deployment services. The attack vector is likely remote, via crafted JWKS data at a trusted repository endpoint.