Description

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-18T18:19:34.343Z",
  "pubdate": "2026-08-18T18:19:34.343Z",
  "executiveSummary": "Kraken agents suffer from an insufficient cryptographic validation vulnerability during peer-to-peer blob downloads.\nThe vulnerability allows malicious actors or network-positioned attackers to perform cache poisoning by substituting legitimate content with arbitrary payloads.\nAffected systems rely exclusively on weak CRC32 checksums for piece-level validation instead of verifying downloaded blobs against their requested cryptographic SHA-256 digests prior to committing data into the content-addressable cache.\nAttackers capable of intercepting agent-to-agent communications or acting as malicious peers can exploit this flaw by supplying maliciously crafted content containing forged CRC32 checksum corrections.\nThis circumvents integrity checks, resulting in poisoned cache entries containing attacker-controlled container image layers or manifests.\nSubsequent execution and re-seeding of the poisoned content by other hosts in the cluster amplifies the risk across the infrastructure, posing severe threats to software supply chain integrity and cluster-wide execution security.",
  "technicalDetails": "The root cause of this vulnerability lies in the inadequate validation logic implemented within the Kraken agent's peer-to-peer download and caching pipeline.\nSpecifically, the agent processes incoming blob data by validating individual pieces against CRC32 checksums rather than enforcing end-to-end cryptographic verification using SHA-256 digests for the complete requested blob before committing the data to the content-addressable cache.\nCRC32 is a non-cryptographic checksum algorithm that is exceptionally vulnerable to collision attacks and intentional manipulation.\nAn attacker positioned on the agent-to-agent network path or operating as a malicious participant in the peer-to-peer network can leverage the mathematical weaknesses of CRC32 to generate custom payloads.\nBy appending collision bytes or forging CRC32 correction values within the substituted content, the attacker ensures that the manipulated data successfully passes the piece-level validation checks performed by the Kraken agent.\nThe step-by-step attack flow proceeds as follows: First, a Kraken agent requests a specific container image layer or manifest identified by a target SHA-256 digest via the peer-to-peer network. Second, a malicious peer responds by serving fabricated content engineered to match the expected CRC32 checksum of the requested piece while containing arbitrary malicious instructions or backdoored binaries. Third, the receiving Kraken agent validates the piece using the weak CRC32 algorithm, falsely assumes data integrity, and commits the malicious blob directly into its local content-addressable cache without verifying the overarching SHA-256 digest. Finally, because the compromised blob is now stored locally, the Kraken agent actively re-seeds this poisoned content to other hosts querying the cache, leading to widespread propagation and execution of unauthorized container image layers across the cluster.\nThis flaw requires network access to the peer-to-peer communication channels utilized by Kraken agents, allowing unauthenticated or compromised peers to inject arbitrary data into the caching infrastructure without triggering standard cryptographic alerts."
}