In Contrast versions prior to 1.12.1 the secure persistent volume feature does not authenticate LUKS2 volume metadata. When cryptsetup versions earlier than 2.8.1 receive a header that specifies the null cipher (cipher_null-ecb) it accepts the volume without error. Contrast’s initializer treats any device that opens with the expected seed as protected, so the guest will mount the attacker‑supplied volume and write sensitive data in plaintext or with a key known to the attacker. The host, having the volume available, can read that data, violating confidentiality. The lack of integrity protection in these persistent volumes means the impact is limited to confidentiality rather than data modification.

Affected systems This flaw affects the edgelesssys Contrast runtime for confidential containers in all releases before 1.12.1, including 1.12.0 and earlier. If a host runs an older cryptsetup tool (pre‑2.8.1) alongside these Contrast versions, the vulnerability remains exploitable. Users of 1.12.1 or newer, especially those upgraded to 1.13.0, receive mitigations that disable null ciphers when a passphrase is present and add detached‑header validation and integrity protection.

The CVSS score of 6.9 rates this as a high‑severity vulnerability. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the lack of listing in the CISA KEV catalog indicates no known large‑scale exploitation. The likely attack vector requires a malicious or compromised host that can supply a crafted LUKS2 volume to a pod VM; there is no indication that remote code execution or network‑based attacks are possible without host involvement.