Edgeless Systems Contrast CVE-2025-71424

All three conditions must hold simultaneously: (1) a bare-metal Contrast deployment - Azure AKS deployments are explicitly NOT affected; (2) a container image that declares at least one VOLUME directive (Dockerfile VOLUME / OCI config.volumes); and (3) no Kubernetes mount defined at that VOLUME path, so containerd auto-creates the mount point. The attacker is the untrusted host underlying the confidential container. Exploitation is limited to integrity impact on that mount-point directory; there is no confidentiality or availability effect. The straightforward workaround (explicitly mounting an emptyDir at every VOLUME path) further narrows exposure to misconfigured deployments only.

This is a low-real-world-risk issue despite touching confidential-computing security guarantees. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, base 5.1 MEDIUM) is internally consistent with the description: integrity-only impact (VI:L), no confidentiality or availability loss, adjacent attack vector, and low privileges. No EPSS score, no CISA KEV listing, and no public POC were provided, so all exploitation signals point to no active or imminent exploitation. There is no SSVC decision data in the input. The most important limiting factor is the tightly-scoped precondition set: exploitation only works on bare-metal Contrast deployments (Azure AKS is explicitly NOT affected), against images that declare at least one VOLUME with no corresponding Kubernetes mount at that path. Note a labeling conflict worth flagging: the input Tags mark this 'Information Disclosure', but the CVSS vector sets VC:N (no confidentiality impact) and the advisory describes only host-controlled writes - this is an integrity flaw, not disclosure. The 'attacker' here is the untrusted host, which is precisely the actor confidential computing is meant to defend against, so the vulnerability is meaningful within that threat model but narrow in real-world reach.

An operator runs a Contrast confidential container on bare-metal from an image whose Dockerfile declares a VOLUME (e.g. a data directory) but forgets to mount a Kubernetes volume at that path. containerd auto-creates the mount point, and the untrusted host machine writes an arbitrary file tree beneath it inside the confidential container, tampering with a directory the application relies on for core functionality. No public exploit code has been identified at time of analysis.