CVE-2026-109358: Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Edgeless Systems Contrastto a version that resolves this vulnerability.Fixed in 1.24.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Nodes running affected Edgeless Systems Contrast versions are exposed when a local unprivileged user can access the node. The vulnerability is local; the provided information does not indicate remote exploitation.
What does an attacker need to exploit it?
An attacker needs local, unprivileged access to an affected node and the ability to modify the world-writable containerd configuration file. They can alter settings such as the runc location to escalate privileges.
Which versions are affected?
Contrast versions from 1.8.0 before 1.24.1 are affected. Version 1.24.1 is not included in the stated affected range.
How can I check whether a node is vulnerable?
Check the installed Contrast version and inspect the containerd configuration created by the node installer. Affected installations have this configuration writable by all users, with mode 0666.