CVE-2026-109358 in Contrast
Summary
by MITRE • 10/12/2026
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Edgeless Systems Contrast versions prior to 1.24.1 represents a critical misconfiguration within the system's initialization process that directly facilitates privilege escalation through improper file permission management. Specifically, during the execution of the node installer component, the configuration file for containerd is created with world-writable permissions, denoted by the octal value 0666. This setting grants read, write, and execute access to all users on the system, including unprivileged accounts that typically lack administrative rights. In a secure operating environment, configuration files governing critical infrastructure components like container runtimes should be restricted to root or specific service accounts with minimal necessary permissions to prevent unauthorized modification. The failure to enforce restrictive file modes during installation creates an immediate and exploitable attack surface on any node running this software version.
From a technical perspective, the core flaw lies in the lack of proper access control lists or standard Unix permission bits being applied to the containerd configuration file upon its creation. By allowing global write access, the system inadvertently permits local unprivileged users to alter runtime parameters without authentication. An attacker with low-level shell access can exploit this by editing the configuration file to redirect critical execution paths. A primary example of such exploitation involves modifying the path associated with runc, which is the standard container runtime used by containerd. By changing the specified binary location to a malicious executable crafted by the attacker, subsequent operations that rely on containerd will invoke the rogue program instead of the legitimate system utility. This mechanism allows for arbitrary code execution within the context of the service account or root privileges depending on how containerd is configured and launched, effectively bypassing standard user isolation boundaries.
The operational impact of this vulnerability is severe, as it enables a local unprivileged attacker to achieve full control over the affected node. Once the configuration is modified, any action that triggers the use of runc through containerd will execute the attacker's payload with elevated privileges. This can lead to complete compromise of the host system, including access to sensitive data stored on the node, manipulation of running containers, and potential lateral movement within a cluster environment if other nodes are reachable from this compromised instance. The vulnerability undermines the fundamental security model of multi-tenant environments where isolation between users is paramount. It effectively neutralizes any non-root user restrictions imposed by the operating system regarding container runtime configurations, turning a standard development or operational node into an open gateway for privilege escalation attacks.
This issue aligns with CWE-732, which describes improper permission assignment for critical resources, and falls under MITRE ATT&CK technique T1068, specifically related to exploitation for privilege escalation via software misconfigurations. To mitigate this risk, organizations must immediately upgrade Edgeless Systems Contrast to version 1.24.1 or later where the file permissions are correctly restricted during installation. For systems that cannot be upgraded instantly, a manual remediation step involves locating the containerd configuration file and applying restrictive permissions using standard operating system commands such as chmod 600 or chmod 640, ensuring only root or designated service accounts can read and write to it. Additionally, implementing strict monitoring on changes to critical runtime configuration files can provide early detection of any unauthorized modifications attempting to exploit this weakness before full compromise occurs.