CVE-2026-52727

Name of the Vulnerable Software and Affected Versions lxc-ci Arch Linux images published prior to 2026-05-28

Description Images built from images/archlinux.yaml contain a shared pacman local-signing private key located in /etc/pacman.d/gnupg, which is redistributed to all containers or virtual machines created from the image. An attacker capable of controlling an HTTP package mirror or intercepting mirror traffic can use this shared private key to sign malicious packages. Because the clients trust this key, installing these modified packages allows for arbitrary code execution with root privileges on the client system.

Recommendations Update to Arch Linux images published on or after 2026-05-28.