CVE-2026-55222

Name of the Vulnerable Software and Affected Versions Isar versions 0.11 through 0.12

Description During bootstrap setup, the directory /etc/apt/trusted.gpg.d is created manually to deploy local keys, resulting in the directory being owned by the user executing Isar rather than root. If the calling user's ID matches that of an unprivileged user within the generated image, that user can modify existing keys or deploy new ones. This action compromises the integrity protection of the apt repository. This issue does not affect images using an immutable rootfs or environments where apt is not invoked. Exploitation requires additional steps, such as manipulating a remote repository or intercepting non-secure communications.

Recommendations Update Isar to the version containing commit 29e84ed.