Edgeless Systems Contrast CVE-2026-109358

Requires a local unprivileged user account on a node where the Contrast node installer has deployed the containerd configuration with world-writable (0666) permissions, on affected versions 1.8.0 up to (but not including) 1.24.1. The concrete prerequisite is write access to the containerd config file, which the installer itself exposes; the attacker then overwrites a runtime setting such as the runc binary location. Exploitation is limited to attackers who already have local presence on the node - there is no network vector and no path for remote or unauthenticated actors - which substantially narrows realistic exposure to multi-tenant or shared-node deployments.

This is a credible local privilege-escalation issue rather than a remotely wormable threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the description agree cleanly: an attacker needs an existing low-privileged local account on the affected node, no user interaction, and low attack complexity, with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) scoped to the local system (SC:N/SI:N/SA:N). The 8.5 score is driven by the full compromise of the node once the condition is met. Exploitation status is 'no public exploit identified at time of analysis' - there is no KEV listing, no EPSS score, and no POC referenced, so there is no evidence of active or widespread exploitation; this is a priority primarily for operators who run Contrast and have multi-tenant or shared-node access models. No signals conflict here: the local attack vector, PR:L, and the 'local unprivileged users' wording in the description are mutually consistent. The main unknown is real-world exposure - EPSS, KEV, and POC data are all absent from the input, so likelihood of exploitation cannot be quantified beyond the technical prerequisites.

On a node where the Contrast node installer has run, a local unprivileged user discovers the containerd configuration file is world-writable (0666). The user edits the config to point the runc binary location at an attacker-controlled executable, so that the next container runtime invocation runs their code with elevated (root/runtime) privileges on the node. No public exploit code is referenced, and the attack requires only a pre-existing low-privilege local account and standard low-complexity steps.