Research / Finding
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery F-APKO-002
Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.
Read the evidence · View in research browse
Recorded evidence
6.5medium
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Fixed in: apko v1.2.7
patched
details
Finding IDs F-APKO-002 CVE CVE-2026-42576 GHSA GHSA-m7hm-vm4x-28jf Status patched Fixed in apko v1.2.7 Recorded credit reporter: @1seal Note panic on non-RSA JWKS key in apko DiscoverKeys causes crash during key discovery CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE registry state PUBLISHED CVE state checked 23 Sep 2026 F-APKO-002: Input / state handling. An unexpected JWKS key type triggers a panic. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-APKO-002
Security area (1seal assessment): Availability. An unexpected JWKS key type triggers a panic. Reviewed 24 Sep 2026.
Clarify or correct this record privately . The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy .
How this page groups evidence This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules .