CVE-2026-75625
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
- EPSS probability
- 0.20%
- CWE
- CWE-354
- Published
- 2026-08-18
- Last modified
- 2026-08-18
Affected products
- uber kraken
Weakness type
Related vulnerabilities
- CVE-2026-72929 — Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-20354 — Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
- CVE-2026-82549 — Linux Foundation Magma SecurityModeComplete integrity check
- CVE-2026-75803 — AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
- CVE-2026-12817 — OpenPGP AEAD decryption skips final tag on chunk-aligned data
- CVE-2026-12816 — IESEngine stream-mode MAC forgery via length-dependent KDF split
- CVE-2026-12803 — KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)
- CVE-2026-12802 — CMS AuthEnvelopedData fails to enforce tag-length on decryption