Edgeless Systems Contrast: Privilege escalation via world-writable containerd config
Summary
Contrast versions 1.8.0 up to 1.24.0 write the containerd configuration on Kubernetes nodes with world-writable permissions (0666). A local user without administrative rights on a node can modify this file, for example to replace the runc location, and so gain higher privileges on that node. Exploitation requires local access to the node and is not possible remotely. The vendor rates it High (CVSS 3.1: 7.8), while the CVE record lists CVSS 4.0: 8.5.
Affected
- Contrast 1.8.0 up to, but not including, 1.24.1
Fixed in
- Contrast 1.24.1, which removes the world-writable permission. The upgrade does not correct existing files; permissions must be checked and fixed manually.
Workaround
- Delete the node installer after it has finished and manually fix the permissions of containerd.conf on all nodes.
- Make the containerd config directory accessible to privileged users only.
Exploitation
- No exploitation in the wild is known. CISA SSVC lists exploitation as none and not automatable.
- VulDB reports that no exploit exists. No public proof of concept was found in the research.
- The CISA KEV status was not checked directly.
Our recommendation
- Check whether any cluster uses edgelesssys/contrast and which version.
- Upgrade to Contrast 1.24.1 or later.
- Check the permissions of the containerd config on all existing nodes and correct them manually.
- Restrict local shell access to Kubernetes nodes to trusted administrators.
- Contrast is a specialised tool, so most SMEs are probably not affected; confirm before prioritising.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-376m-h37w-4rvq github.com
- VulnCheck advisory www.vulncheck.com
- Contrast release 1.24.1 github.com
- OSV entry CVE-2026-109358 osv.dev
- VulDB entry 417172 vuldb.com
- OpenCVE CVE-2026-109358 app.opencve.io
- EUVD-2026-97660 (Vulners) vulners.com
- CyStack vulnerability database entry for Contrast cystack.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:52.
Original description (NVD)
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.