CVE-2026-75625: Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Agents that download blobs from peers are exposed, as are other hosts that later receive and execute the poisoned layers or manifests through re-seeding. An attacker must be able to act as a malicious peer or interfere with traffic on the agent-to-agent path.
What must an attacker do to poison the cache?
The issue occurs because downloaded blobs are committed to the content-addressable cache without verification against the requested SHA-256 digest. Per-piece CRC32 validation alone can be bypassed using forged CRC32 corrections, allowing substituted content to be accepted.
What is the likely impact after cache poisoning?
A successful attack can place attacker-chosen container image layers or manifests into the cache. Those objects can then be re-seeded to other hosts and executed there.