Ilbers Isar up to 1.1 Bootstrap Setup /etc/apt/trusted.gpg.d privileges management

Summaryinfo

A vulnerability was found in Ilbers Isar up to 1.1. It has been rated as problematic. The impacted element is an unknown function of the file /etc/apt/trusted.gpg.d of the component Bootstrap Setup. This manipulation causes privileges management. This vulnerability is handled as CVE-2026-55222. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as problematic was found in Ilbers Isar up to 1.1. Affected by this vulnerability is an unknown function of the file /etc/apt/trusted.gpg.d of the component Bootstrap Setup. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect integrity. The summary by CVE is:

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user's id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, silently breaking the apt repo integrity protection. The issue is has no impact on those images that use an immutable rootfs, or if apt is never invoked. Changing only the keys does not trigger an exploit, it's just one step in a chain. An attacker would also have to manipulate a remote repo or intercept non-secure communication with it. This issue has been patched via commit 29e84ed.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-55222 since 06/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Applying the patch 29e84ed is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Ilbers

Name

• Isar

Version

• 1.0
• 1.1

Website

• Product: https://github.com/ilbers/isar/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion