Contrast is a runtime for confidential containers on Kubernetes. In versions up to 1.9.0, handling of the Docker VOLUME directive is incomplete: the directive is treated only as metadata, but containerd mounts the specified path regardless of a Kubernetes volume. The runtime must send data to the Kata agent to populate this mount, and because the VOLUME can point to an arbitrary directory, an untrusted host can write arbitrary data beneath that mount point inside the confidential container. This compromises the integrity of directories that are critical to the application, even though the container remains isolated from the host. The weakness is a CWE‑693: Improper Authorization.

The affected product is Edgeless Systems Contrast, versions 1.9.0 and earlier. The vulnerability manifests when a container image declares at least one VOLUME and the Kubernetes configuration does not bind a corresponding host volume. It does not affect AKS deployments because AKS implements an alternative volume handling for Contrast. Version 1.9.1 through the release notes disables the problematic configuration during generation.

The CVSS score of 5.1 places the vulnerability in the medium impact range. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation. Likely exploitation requires the attacker to have host or cluster‑level access to deploy or modify a container image that declares a VOLUME, or to run Impacted Contrast on bare‑metal nodes. Once executed, the attacker can overwrite files inside the confidential container, potentially altering application behavior or installing malicious components.