CVE-2026-109358: high-severity vulnerability in edgelesssys contrast
Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.1%
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
edgelesssys · contrastRelated CVEs — edgelesssys contrast
In the same product, most dangerous first.
CVE-2026-100835CRITICALContrast before 1.16.0 Remote Attestation Relay AttackEPSS 0.3%CVE-2026-100833HIGHContrast before 1.23.1 Image Substitution via Policy GenerationEPSS 0.2%CVE-2026-100838HIGHContrast before 1.19.1 CopyFile Policy Symlink SubversionEPSS 0.2%CVE-2026-100837MEDIUMEdgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix MatchingEPSS 0.2%CVE-2025-71423HIGHEdgelesssys Contrast before 1.12.2 Workload Secrets Information DisclosureEPSS 0.2%CVE-2025-71425HIGHContrast before 1.8.1 Information Disclosure via LoggingEPSS 0.2%