CVE-2026-52727

Overview

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

Description

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted. Installing those packages permits arbitrary code execution as root on the client system. This issue is fixed in Arch Linux images published on or after 2026-05-28.

Impact

Integrity and confidentiality are severely compromised, allowing threat actors to manipulate package installations and execute arbitrary root-level code on affected systems. Availability may also be impacted if malicious updates cause system instability. Users and organizations deploying Arch Linux containers or virtual machines derived from vulnerable base images are directly affected.

Remediation

Upgrade to Arch Linux container and virtual machine images published on or after May 28, 2026. For existing deployments, regenerate the pacman local-signing keyring on affected instances using standard pacman-key initialization commands. Ensure continuous integration pipelines are audited to prevent hardcoded cryptographic material.

Risk context

The vulnerability holds a CVSS v3 score of 7.2 (High) due to the potential for complete root compromise via compromised package updates. However, the current EPSS score is very low at 0.00071, indicating minimal active exploitation in the wild, though remediation should still be prioritized for template hygiene.

Affected products

• lxc-ci
• Arch Linux LXC images
• Arch Linux VM images