Threats affecting pkg:github/lxc/lxc-ci

A vulnerability in lxc-ci's Arch Linux images prior to 2026-05-28 involves the use of a hard-coded pacman local-signing private key. This key is embedded in the image and distributed to all containers or virtual machines created from it. An attacker who can control or intercept HTTP package mirror traffic can misuse this key to sign malicious packages, which affected clients will trust and install. Successful exploitation allows arbitrary code execution with root privileges on the client system. The issue is fixed in Arch Linux images published on or after 2026-05-28.