{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/contrast--1.24.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:edgelesssystems:contrast:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-109358"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contrast (\u003c 1.24.1)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","linux","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Edgeless Systems"],"content_html":"\u003cp\u003eEdgeless Systems Contrast versions 1.8.0 through 1.24.0 are affected by a security vulnerability regarding improper file permissions. The node installer for the platform creates the containerd configuration file with world-writable (0666) permissions on the underlying Linux host. This flaw allows any local unprivileged user to modify the configuration file. By altering parameters within the containerd configuration, such as redirecting the path of the runc binary to a malicious executable, an attacker can cause the service to execute arbitrary code with elevated privileges, effectively resulting in local privilege escalation. This vulnerability poses a high risk in multi-tenant environments or systems where untrusted users have local shell access to the node.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an unprivileged local user to gain root-level execution on the affected node. This can lead to full system compromise, data theft, and persistence, specifically impacting environments running Edgeless Systems Contrast for secure container orchestration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering and system administration teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Edgeless Systems Contrast to version 1.24.1 or later to resolve the underlying installer behavior and ensure correct file permissions (0600 or 0644).\u003c/li\u003e\n\u003cli\u003eAudit existing deployments of Contrast for world-writable configuration files in the containerd path by checking file permissions for /etc/containerd/config.toml (or equivalent).\u003c/li\u003e\n\u003cli\u003eUse system monitoring to detect unauthorized modifications to containerd configuration files by monitoring file integrity for the configuration directory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:37:57Z","date_published":"2026-10-12T18:37:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-edgeless-contrast-vuln/","summary":"Edgeless Systems Contrast versions 1.8.0 through 1.24.0 contain a world-writable containerd configuration file vulnerability, allowing local unprivileged users to achieve privilege escalation.","title":"Incorrect Permissions in Edgeless Systems Contrast","url":"https://feed.craftedsignal.io/briefs/2026-10-edgeless-contrast-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - Contrast (\u003c 1.24.1)","version":"https://jsonfeed.org/version/1.1"}