CVE-2026-55222 Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user the one that executes Isar instead of root. If...

CVE-2026-55222

The Isar root filesystem generation system (versions 0.11 and newer ) contains a flaw where the /etc/apt/trusted.gpg.d directory is manually created during bootstrap setup with ownership assigned to the calling user instead of root . If an unprivileged user shares the same ID as the calling user,...