CyberRota Analysis
AI-GeneratedLXC continuous integration and image-build scripts for Linux are vulnerable due to the retention of the pacman local-signing private key in built images, which are distributed to all containers or virtual machines created from those images. This flaw allows an attacker controlling an HTTP package mirror or intercepting traffic to sign malicious packages that clients may trust, leading to potential arbitrary code execution with root privileges. Organizations using affected Arch Linux images prior to May 28, 2026, should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted. Installing those packages permits arbitrary code execution as root on the client system. This issue is fixed in Arch Linux images published on or after 2026-05-28.