# CVE-2025-71422: Edgeless Systems Contrast insecure LUKS2 persistent volume in initializer

Source: https://junglewise.ai/threats/cve-2025-71422-contrast-is-a-kubernetes-runtime-for-confidential-containers-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2025-71422 · Severity: medium · CVSS 5.7 · Published 2026-09-27

Contrast is a Kubernetes runtime that runs confidential workloads in isolated VMs with encrypted storage. A malicious host can provide a crafted disk volume with weak or null encryption that the Contrast guest will accept and use, exposing secret encryption keys and allowing the host to read all data written to that volume in plaintext. This affects encrypted persistent storage volumes that should protect sensitive application data.

Technologies: [Edgeless Systems Contrast](https://junglewise.ai/threats/technologies/contrast). Vendors: [Edgeless Systems](https://junglewise.ai/threats/vendors/edgeless-systems).

## Quick answers

**Is CVE-2025-71422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71422 being exploited in the wild.

**How severe is CVE-2025-71422?** Medium severity, with a CVSS score of 5.7, published 27 September 2026.

**Which products and versions are affected?** Edgeless Systems Contrast before 1.12.1.

**Is there a fix for CVE-2025-71422?** A patch was published on 2025-10-27: v1.12.1 released with cryptsetup 2.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71422 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2025-71422?** Check whether you run Edgeless Systems Contrast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Contrast Initializer uses cryptsetup to open encrypted persistent volumes, assuming success means the volume is protected. However, LUKS2 metadata is not authenticated and cryptsetup versions before 2.8.1 accept null-cipher keyslots without error. An attacker with control over the host storage can create a malicious LUKS2 volume with cipher_null-ecb that opens successfully with any passphrase, causing the guest to write secrets under an attacker-known or plaintext key. Fixed in Contrast v1.12.1 (upgrading cryptsetup to 2.8.1) and hardened further in v1.13.0 (detached-header validation and integrity protection).

## Affected products

- Edgeless Systems Contrast before 1.12.1

## Timeline

- 2025-10-27: disclosed
- 2025-10-27: patched: v1.12.1 released with cryptsetup 2.8.1
- 2025-10-27: patched: v1.13.0 released with detached-header validation and integrity protection

## References

- [https://github.com/edgelesssys/contrast/security/advisories/GHSA-f5p4-p5q5-jv3h](https://github.com/edgelesssys/contrast/security/advisories/GHSA-f5p4-p5q5-jv3h)
- [https://www.vulncheck.com/advisories/contrast-before-1.12.1-insecure-luks2-persistent-storage](https://www.vulncheck.com/advisories/contrast-before-1.12.1-insecure-luks2-persistent-storage)

## Related threats

- [Contrast improper verification in Coordinator peer recovery](https://junglewise.ai/threats/cve-2026-109359-contrast-1-8-0-before-1-24-1-contains-an-improper-verification)
- [Edgeless Systems Contrast privilege escalation in node installer](https://junglewise.ai/threats/cve-2026-109358-edgeless-systems-contrast-1-8-0-before-1-24-1-contains-an)
- [Edgeless Systems Contrast AML injection in ACPI handler](https://junglewise.ai/threats/cve-2026-100839-contrast-is-a-confidential-computing-runtime-for-kubernetes-in)
- [Edgeless Systems Contrast arbitrary filesystem write in CopyFile policy](https://junglewise.ai/threats/cve-2026-100838-contrast-is-a-confidential-computing-runtime-for-kubernetes-in)
- [Edgeless Systems Contrast panic in ciphertextContainer.UnmarshalJSON](https://junglewise.ai/threats/cve-2026-100836-contrast-through-1-20-0-contains-a-panic-vulnerability-in-the)