lxc-ci: lxc-ci contains continuous integration and image-build scripts for LXC
CVE-2026-52727 is fixed in lxc-ci on 1 platform by DEBIAN-CVE-2026-52727 (version 0.0~git20260914.1b378a7-1), released October 3, 2026. It is not reported as exploited. Patch Radar priority: High.
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted. Installing those packages permits arbitrary code execution as root on the client system. This issue is fixed in Arch Linux images published on or after 2026-05-28.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| lxc-ci · Debian 14 | 0.0~git20260914.1b378a7-1 | DEBIAN-CVE-2026-52727 | Oct 3, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.