CVE-2026-52727: lxc-ci: Pacman keyring stored in archlinux image with a private key
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted. Installing those packages permits arbitrary code execution as root on the client system. This issue is fixed in Arch Linux images published on or after 2026-05-28.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arch Linux imagesto a version that resolves this vulnerability.Fixed in 2026-05-28 - Operational
For any Arch Linux images built from images/archlinux.yaml prior to 2026-05-28, assume the pacman local-signing private key in /etc/pacman.d/gnupg was exposed and rotate/recreate the image (or otherwise remove and replace the retained pacman local-signing private key) before creating additional containers/virtual machines.
Event History
Frequently Asked Questions
Which systems are affected?
Arch Linux containers or virtual machines created from images built with images/archlinux.yaml and published before 2026-05-28 are affected. Arch Linux images published on or after 2026-05-28 contain the fix.
What does an attacker need to exploit this issue?
An attacker must control an HTTP package mirror or be able to intercept traffic to a mirror. They can then sign modified packages with the shared key, causing affected clients to accept them as trusted.
What is the impact if exploitation succeeds?
Installing a malicious package accepted through the compromised trust model permits arbitrary code execution as root on the affected client system.
How can I determine whether an existing instance is at risk?
Determine whether the container or virtual machine was created from an Arch Linux image published before 2026-05-28 and whether it was built from images/archlinux.yaml. Those images redistributed the shared pacman local-signing private key in /etc/pacman.d/gnupg.