Directory Ownership Vulnerability in Isar Integration System

CVE-2026-55222

What is CVE-2026-55222?

The Isar integration system for automated root filesystem generation has a critical flaw where the /etc/apt/trusted.gpg.d directory is created under the ownership of the calling user, rather than the root user, during the bootstrap setup. This misconfiguration in versions 0.11 and newer allows an unprivileged user within the image, who shares the same user ID as the calling user, to potentially alter crucial keys and introduce new ones. As a result, it compromises the integrity of APT repositories. However, this vulnerability does not affect images that utilize an immutable root filesystem or cases where APT is not utilized. While merely changing keys is insufficient for an exploit, it can facilitate further attacks if combined with remote repository manipulation or by intercepting insecure communications.

References