---
id: "CVE-2026-55222"
kind: "vulnerability"
aliases: ["CVE-2026-55222"]
title: "Isar: wrong directory ownership lets an image user tamper with apt keys"
severity: "medium"
cvss: 5.1
epss: 0.00136
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apt", "embedded-linux", "image-builds", "isar", "package"]
not_affected_if: ["apt-never-invoked", "immutable-rootfs", "isar-below-0.11"]
published_at: "2026-10-23T15:17:32+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55222", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-55222", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Isar: wrong directory ownership lets an image user tamper with apt keys

Isar, a tool that builds Linux root filesystems, creates the apt trusted keyring directory owned by the user running the build instead of root from version 0.11 on. A local user inside the image whose ID matches that build user could replace or add apt signing keys, which weakens apt's repository integrity checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Isar version used to build images, for example with `git -C isar describe --tags` or the version in the build tree, and see whether it is `0.11` or newer.
- Inspect the built image's `/etc/apt/trusted.gpg.d` ownership with `ls -ld /etc/apt/trusted.gpg.d` and look for a non-root owner.

## Fix

- Update Isar to the release that includes commit `29e84ed`; the exact fixed version is unknown from the sources.
- Rebuild images after the update so `/etc/apt/trusted.gpg.d` is owned by root.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55222
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-55222

## From the sources

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user's id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, silently breaking the apt repo integrity protection. The issue is has no impact on those images that use an immutable rootfs, or if apt is never invoked. Changing only the keys does not trigger an exploit, it's just one step in a chain. An attacker would also have to manipulate a remote repo or intercept non-secure communication with it. This issue has been patched via commit 29e84ed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_