CVE-2026-55222 Details
Description
Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user's id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, silently breaking the apt repo integrity protection. The issue is has no impact on those images that use an immutable rootfs, or if apt is never invoked. Changing only the keys does not trigger an exploit, it's just one step in a chain. An attacker would also have to manipulate a remote repo or intercept non-secure communication with it. This issue has been patched via commit 29e84ed.
A vulnerability exists in Isar versions 0.11 and newer, where the directory for APT trusted GPG keys is created during the bootstrap process. This directory is owned by the user executing Isar, rather than by root. If this user's ID matches that of an unprivileged user within the generated image, it could lead to unauthorized alterations of APT repository keys, compromising repository integrity. This issue does not affect images with an immutable root filesystem or those that do not use APT. Exploitation would require additional manipulation of a remote repository or interception of unsecure communications with it.
The vulnerability has been patched by changing the ownership of the APT trusted GPG directory to root. Users can apply this patch by updating to the version that includes the fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ilbers/isar/commit/29e84ed301c8d25c570300cf82b563b7961392b0 | [email protected] | Source CodeVendor |
| https://github.com/ilbers/isar/security/advisories/GHSA-rq66-pfw5-whqq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1290 | Incorrect Decoding of Security Identifiers | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Isar | >= 0.11 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |