CVE-2026-109358 Details
Description
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
A vulnerability exists in Edgeless Systems Contrast versions 1.8.0 prior to 1.24.1, where the node installer creates the containerd configuration with world-writable permissions. This flaw allows local unprivileged users to alter the containerd configuration, such as changing the runc location, potentially leading to unauthorized privilege escalation.
Users are advised to update to Contrast version 1.24.1 or later, where this vulnerability has been fixed. For clusters that previously hosted affected versions, it is important to manually update the permissions on the containerd configuration file. As an alternative, the nodeinstaller can be deleted after it has completed its task, and the permissions for 'containerd.conf' can be manually corrected on all nodes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Edgeless Systems Contrast | <= 1.24.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |