CVE-2026-75625: Kraken Agent RCE Vulnerability

CVE-2026-75625 Overview

CVE-2026-75625 is a cache poisoning vulnerability in Uber's Kraken peer-to-peer container image distribution system. Kraken agents download blobs from peers and commit them to a content-addressable cache without verifying the resulting content against the requested SHA-256 digest. Agents validate individual pieces using CRC32 checksums, which attackers can trivially forge. A malicious peer or an attacker on the agent-to-agent path can substitute container image layers or manifests with attacker-controlled content. Poisoned blobs are then re-seeded across the swarm and executed by other hosts pulling the image. The issue is tracked as [CWE-354: Improper Validation of Integrity Check Value].

Critical Impact
Attackers can poison Kraken's content-addressable cache with malicious container image layers, leading to code execution across every host that pulls the affected image.

Affected Products

Uber Kraken peer-to-peer container registry
Kraken agents using lib/torrent/storage/agentstorage/torrent.go
Downstream container hosts consuming images distributed via Kraken

Discovery Timeline

2026-08-18 - CVE-2026-75625 published to the National Vulnerability Database
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75625

Vulnerability Analysis

Kraken distributes container image blobs between agents using a BitTorrent-style protocol. When an agent requests a blob by SHA-256 digest, peers stream the blob back in pieces. The agent validates each incoming piece against a CRC32 checksum stored in metadata before writing it to the content-addressable store. Once all pieces pass CRC32 validation, the agent commits the blob under the originally requested digest without ever recomputing the SHA-256 hash of the assembled content.

This omission breaks the integrity guarantee that content-addressable storage is supposed to provide. Because CRC32 is a non-cryptographic checksum, an attacker can craft substitute content and adjust bytes within each piece to produce matching CRC32 values. The resulting blob is stored under the digest of the legitimate content, silently replacing it in the cache. Subsequent pulls from other hosts retrieve the attacker-controlled bytes and treat them as trusted because they arrive under an expected digest.

Root Cause

The root cause is missing end-to-end digest verification in the agent storage path. The Kraken agent trusts per-piece CRC32 validation as a proxy for content integrity, but CRC32 is designed to catch transmission errors, not to resist adversarial modification. Refer to the Kraken agent torrent storage source and Kraken issue #638 for the specific code path.

Attack Vector

An attacker on the peer-to-peer network path, or a malicious peer participating in the swarm, responds to blob requests with substituted pieces containing forged CRC32 corrections. The poisoned blob commits to the local cache under the requested digest and is re-seeded to other agents. Any host that pulls the container image consumes attacker-chosen layers or manifests, leading to arbitrary code execution in downstream workloads. See the VulnCheck advisory for additional exploitation context.

Detection Methods for CVE-2026-75625

Indicators of Compromise

Container images whose runtime file contents diverge from the manifest digest recorded upstream
Kraken agent logs showing successful blob commits without a corresponding SHA-256 verification event
Unexpected container processes, network connections, or filesystem writes originating from images distributed via Kraken
Cache entries whose recomputed SHA-256 does not match the storage key

Detection Strategies

Periodically recompute SHA-256 digests of blobs in the Kraken content-addressable store and compare them against the storage key
Reconcile blob digests seen by Kraken agents against the authoritative origin registry
Monitor peer-to-peer traffic for agents serving blobs whose recomputed digests do not match advertised keys

Monitoring Recommendations

Enable audit logging on the Kraken origin and tracker components to correlate blob provenance across agents
Alert on container workloads whose image layers change without a corresponding registry push event
Track anomalous re-seeding patterns where a single peer disproportionately supplies blobs to the swarm

How to Mitigate CVE-2026-75625

Immediate Actions Required

Isolate untrusted peers from the Kraken agent-to-agent network and restrict swarm membership to authenticated hosts
Purge the Kraken content-addressable cache on all agents and re-pull images directly from the trusted origin
Audit deployed container workloads for images distributed via Kraken since the vulnerability window
Enforce image signature verification (for example, Cosign or Notation) at the container runtime layer to catch poisoned content downstream

Patch Information

No vendor patch is currently referenced in the NVD entry. Track the upstream Kraken repository and Kraken issue #638 for a fix that adds full SHA-256 verification of assembled blobs before commit to the cache. Until a patched release is available, treat Kraken agents as untrusted intermediaries and validate content integrity out-of-band.

Workarounds

Require signed container images and verify signatures at pull time using a policy engine such as Kyverno, OPA/Gatekeeper, or Sigstore policy-controller
Restrict Kraken peer-to-peer traffic to mutually authenticated TLS between known agents to reduce exposure to on-path attackers
Run an out-of-band job that recomputes SHA-256 digests of cached blobs and quarantines mismatches
Reduce blast radius by segmenting Kraken swarms per trust boundary rather than sharing a single global swarm

bash

# Recompute SHA-256 digests of Kraken cache entries and flag mismatches
find /var/cache/kraken -type f | while read blob; do
  expected=$(basename "$blob")
  actual=$(sha256sum "$blob" | awk '{print $1}')
  if [ "$expected" != "$actual" ]; then
    echo "MISMATCH: $blob (expected=$expected actual=$actual)"
  fi
done