CVE-2026-55222: CWE-1290: Incorrect Decoding of Security Identifiers in ilbers isar
Description
CVE-2026-55222 is a vulnerability in ilbers isar versions 0.11 through 1.1 where the /etc/apt/trusted.gpg.d directory is created with ownership of the calling user instead of root during bootstrap setup. This allows an unprivileged user inside the image with the same user ID as the calling user to alter or add apt keys, potentially breaking apt repository integrity. The issue does not affect images with immutable root filesystems or those that do not invoke apt. Exploitation requires additional steps such as manipulating a remote repository or intercepting unsecured communication. The vulnerability has been patched.
CVSS v3.1
Score 5.1medium
Affected software
ilbers
isar
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Isar, an integration system for automated root filesystem generation, in versions 0.11 and newer creates /etc/apt/trusted.gpg.d manually during bootstrap setup. This directory is owned by the user executing Isar rather than root. If this user ID matches an unprivileged user inside the image, that user can modify or add apt keys, undermining apt repository integrity protection. This vulnerability requires a chain of actions including remote repository manipulation or interception of non-secure communication to be exploited. The issue is mitigated if the root filesystem is immutable or if apt is not used. A patch addressing this issue has been applied via commit 29e84ed.
Potential Impact
An attacker with unprivileged user access inside the image, sharing the same user ID as the Isar calling user, can alter or add apt keys, compromising the integrity of apt repositories. This could lead to silent acceptance of malicious packages if combined with external repository manipulation or interception of unsecured communication. There is no direct impact if the root filesystem is immutable or apt is not invoked. The vulnerability does not affect confidentiality or availability directly but impacts integrity.
Mitigation Recommendations
A patch fixing this vulnerability has been applied (commit 29e84ed). Users should update to a version of ilbers isar that includes this fix. For images with immutable root filesystems or those that do not invoke apt, this vulnerability does not apply. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T16:16:32.628Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6adb732a4d27ba8daa35258d
Added to database: 10/23/2026, 14:46:02 UTC
Last enriched: 10/23/2026, 15:00:23 UTC
Last updated: 10/23/2026, 15:26:05 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.