Edgeless Systems Contrast up to 1.9.0 OCI Image privileges management

Summaryinfo

A vulnerability categorized as problematic has been discovered in Edgeless Systems Contrast up to 1.9.0. The affected element is an unknown function of the component OCI Image Handler. Such manipulation leads to privileges management. This vulnerability is listed as CVE-2025-71424. The attack must be carried out locally. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Edgeless Systems Contrast up to 1.9.0. It has been rated as problematic. Affected by this issue is an unknown functionality of the component OCI Image Handler. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is integrity. CVE summarizes:

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile (config.volumes in the OCI image configuration) is only a hint and is not handled specially by Kubernetes, but containerd adds a mount point for it when Kubernetes sets none, requiring the runtime to be able to push arbitrary data to the Kata agent. As a result, on bare-metal Contrast deployments (AKS deployments are not affected) that run an image declaring at least one VOLUME for which no Kubernetes mount exists at that path, the untrusted host can write arbitrary file trees below that mount point inside the confidential container, compromising the integrity of a directory that is typically important to the application's core functionality. Version 1.9.1 fixes the issue by disallowing this configuration in `contrast generate`.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-71424 since 09/27/2026. The exploitation is known to be easy. The attack needs to be approached locally. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.9.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Edgeless Systems

Name

• Contrast

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion