CVE-2026-109358

7.8High

Published 12 Oct 2026 · NVD status: Received

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-732

The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ad · In-content banner

NVD description

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.

References

https://github.com/edgelesssys/contrast/security/advisories/GHSA-376m-h37w-4rvq
https://www.vulncheck.com/advisories/edgeless-systems-contrast-1.8.0-before-1.24.1-world-writable-containerd-config-privilege-escalation

Source: nvd.nist.gov/vuln/detail/CVE-2026-109358