Peer-to-Peer Download Cache Poisoning in Kraken Agents by Uber

CVE-2026-75625

What is CVE-2026-75625?

Kraken agents exhibit a critical vulnerability that compromises the integrity of the content-addressable cache. Specifically, these agents fail to accurately verify peer-to-peer downloaded blobs against their intended SHA-256 digest. Instead, they only rely on CRC32 checksums for piece validation, which can be manipulated by attackers. As a result, malicious peers can introduce corrupted content that passes validation through forged CRC32 corrections. This enables attackers to compromise the cache with their own container image layers or manifests, which are then executed on other hosts, posing significant security risks.

References