CVE-2026-75625Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass
Updated under an hour ago ()
Does this affect you?
It affects uber kraken. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.
- CVSS
- 9.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-354
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Sep 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
uber kraken uber:kraken (from the name) | through 0.1.27 | CNA record |
References
- https://github.com/uber/kraken/issues/638issue-tracking
- https://github.com/uber/krakenproduct
- https://github.com/uber/kraken/blob/master/lib/torrent/storage/agentstorage/torrent.gotechnical-description
- https://www.vulncheck.com/advisories/kraken-agents-peer-to-peer-download-cache-poisoning-via-digest-verification-bypassthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.