CVE-2026-75625

critical

Description

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.

References

https://www.vulncheck.com/advisories/kraken-agents-peer-to-peer-download-cache-poisoning-via-digest-verification-bypass

https://github.com/uber/kraken/issues/638

https://github.com/uber/kraken/blob/master/lib/torrent/storage/agentstorage/torrent.go

https://github.com/uber/kraken

Details

Source: Mitre, NVD

Published: 2026-08-18

Updated: 2026-08-18

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.1

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.002