{"cve":"CVE-2025-71422","nvd":{"published":"2026-09-27T02:17:11.040","modified":"2026-10-14T13:10:00.187","status":"Deferred","description":"Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a header specifying the null keyslot encryption algorithm (cipher_null-ecb) is accepted without error. Because the Contrast Initializer assumes a device is protected if `cryptsetup open` succeeds with the secret seed, the guest will open the attacker-supplied volume and write secret data in plaintext, or under a volume key known to the attacker, allowing the host to read confidential data that should have been encrypted. Contrast v1.12.1 ships cryptsetup 2.8.1, which disables null ciphers in keyslots when the passphrase is non-empty; v1.13.0 adds detached-header validation in guest memory and integrity protection for secure persistent storage. Contrast persistent volumes were not integrity protected, so integrity impact is not considered.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.7},"cwes":["CWE-347"],"references":["https://github.com/edgelesssys/contrast/security/advisories/GHSA-f5p4-p5q5-jv3h","https://www.vulncheck.com/advisories/contrast-before-1.12.1-insecure-luks2-persistent-storage"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:48.555445741+00:00"},"epss":{"cve":"CVE-2025-71422","score":0.00074,"percentile":0.00066,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-f5p4-p5q5-jv3h","url":"https://osv.dev/vulnerability/GHSA-f5p4-p5q5-jv3h","summary":"Contrast has insecure LUKS2 persistent storage partitions may be opened and used","modified":"2026-09-27T11:55:58.131683901Z","packages":[{"ecosystem":"Go","name":"github.com/edgelesssys/contrast","purl":"pkg:golang/github.com/edgelesssys/contrast","ranges":["<1.12.1"],"fixed":["1.12.1"]}]},{"id":"GO-2025-4078","url":"https://osv.dev/vulnerability/GO-2025-4078","summary":"Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast","modified":"2026-09-27T11:55:58.131683901Z","packages":[{"ecosystem":"Go","name":"github.com/edgelesssys/contrast","purl":"pkg:golang/github.com/edgelesssys/contrast","ranges":["<1.12.1"],"fixed":["1.12.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}