Live › vulnerability › CVE-2026-55222
Go to dashboardIsar, a tool that builds Linux root filesystems, creates the apt trusted keyring directory owned by the user running the build instead of root from version 0.11 on. A local user inside the image whose ID matches that build user could replace or add apt signing keys, which weakens apt's repository integrity checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that use Isar 0.11 or newer to generate root filesystems with apt and ship images where unprivileged users exist inside the image. The exposure needs the build user's numeric ID to match an in-image user, and an attacker also has to manipulate or intercept a remote apt repository. Images with an immutable rootfs or images where apt is never run are not affected.
No product ranges from the sources yet.
git -C isar describe --tags or the version in the build tree, and see whether it is 0.11 or newer./etc/apt/trusted.gpg.d ownership with ls -ld /etc/apt/trusted.gpg.d and look for a non-root owner.29e84ed; the exact fixed version is unknown from the sources./etc/apt/trusted.gpg.d is owned by root.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user's id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, silently breaking the apt repo integrity protection. The issue is has no impact on those images that use an immutable rootfs, or if apt is never invoked. Changing only the keys does not trigger an exploit, it's just one step in a chain. An attacker would also have to manipulate a remote repo or intercept non-secure communication with it. This issue has been patched via commit 29e84ed.
This page as .md · .json · in your agent: get_signal("CVE-2026-55222")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.