CVE-2026-109358

EUVD-2026-97660
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/edgelesssys/contrast/security/advisories/GHSA-376m-h37w-4rvq
https://www.vulncheck.com/advisories/edgeless-systems-contrast-1.8.0-before-1.24.1-world-writable-containerd-config-privilege-escalation