CVE-2025-58356: Constellation has insecure LUKS2 persistent storage partitions which may be opened and used

CVE-2025-58356 · Severity: medium · CVSS 4 · Published 2025-10-27

Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.

Technologies: github.com/edgelesssys/constellation (Go), github.com/edgelesssys/constellation/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2025-58356 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-58356 being exploited in the wild.
How severe is CVE-2025-58356?
Medium severity, with a CVSS score of 4, published 27 October 2025.
Which products and versions are affected?
github.com/edgelesssys/constellation (Go) SEMVER:introduced=0; github.com/edgelesssys/constellation/v2 (Go) SEMVER:introduced=0,fixed=2.24.0.
Is there a fix for CVE-2025-58356?
Yes. github.com/edgelesssys/constellation/v2 (Go): upgrade to 2.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-58356?
Check whether you run github.com/edgelesssys/constellation (Go) or github.com/edgelesssys/constellation/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/edgelesssys/constellation/v2 (Go): upgrade to 2.24.0 or later
    go get github.com/edgelesssys/constellation/v2@v2.24.0

Affected products

  • github.com/edgelesssys/constellation (Go) SEMVER:introduced=0
  • github.com/edgelesssys/constellation/v2 (Go) SEMVER:introduced=0,fixed=2.24.0

Identifiers

  • CVE-2025-58356
  • GHSA-hq76-6gh2-5g4q
  • GO-2025-4076

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.