CVE-2026-75625
CriticalCVSS 9.0Summary
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the cache, relying only on CRC32 checksums. Attackers can substitute content, poisoning the cache with malicious container image layers or manifests that are then executed by other hosts.
Risk Assessment
Cache poisoning can lead to execution of malicious code in container environments, compromising the integrity and security of the entire cluster.
Recommendation
Update Kraken agents to a patched version that verifies SHA-256, and consider additional peer authentication mechanisms.
Original NVD description (English source)
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.