The Contrast installer miswrites the containerd configuration file with world‑writable permissions (0666), allowing any local unprivileged user to modify it. By changing fields such as the runc binary path, a user can cause containerd to run arbitrary code with elevated privileges, effectively escalating to host level. This flaw exemplifies CWE‑732: Incorrect Permission Assignment for a Critical Resource.

All Edgeless Systems Contrast installations from version 1.8.0 up to (but not including) 1.24.1 are vulnerable, as the node installer writes the default containerd config with incorrect permissions. Versions 1.24.1 and later correct the file mode and are not affected.

The CVSS score of 8.5 marks this as a high‑severity vulnerability, although the EPSS score is not available and it is not listed in the CISA KEV catalog, implying limited known exploitation. The attack vector is local; it requires the attacker to have file‑system write access on a node that ran the vulnerable installer. Consequently, the risk is significant for environments where untrusted users or compromised workloads can write to the host.