CVE-2026-75625

Name of the Vulnerable Software and Affected Versions Kraken (affected versions not specified)

Description Kraken agents do not verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing them to the content-addressable cache. Instead, the system relies solely on CRC32 checksums for piece validation. This allows attackers on the agent-to-agent path or malicious peers to provide substituted content with forged CRC32 corrections that pass per-piece checks. This process can poison the cache with attacker-chosen container image layers or manifests, which are then re-seeded and executed by other hosts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.