Unknown · Arch Linux · CVE-2026-52727
**Name of the Vulnerable Software and Affected Versions**
lxc-ci Arch Linux images published prior to 2026-05-28
**Description**
Images built from `images/archlinux.yaml` contain a shared pacman local-signing private key located in `/etc/pacman.d/gnupg`, which is redistributed to all containers or virtual machines created from the image. An attacker capable of controlling an HTTP package mirror or intercepting mirror traffic can use this shared private key to sign malicious packages. Because the clients trust this key, installing these modified packages allows for arbitrary code execution with root privileges on the client system.
**Recommendations**
Update to Arch Linux images published on or after 2026-05-28.