Nixpkgs security tracker
Permalink
CVE-2026-75625
9.1 CRITICAL
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): High (H)
- Subsequent System Impact Integrity (SI): High (H)
- Subsequent System Impact Availability (SA): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): High (H)
- Modified Subsequent System Impact Integrity (MSI): High (H)
- Modified Subsequent System Impact Availability (MSA): High (H)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.
References
-
-
https://github.com/uber/kraken product
-
writePiece/WritePiece in lib/torrent/storage/agentstorage/torrent.go technical-description
Affected products
kraken
- =<0.1.27
Matching in nixpkgs
pkgs.krakenx
Python script to control NZXT cooler Kraken X52/X62/X72
pkgs.gitkraken
Simplifying Git for any OS
pkgs.python313Packages.krakenex
Kraken.com cryptocurrency exchange API
pkgs.python314Packages.krakenex
Kraken.com cryptocurrency exchange API
pkgs.python313Packages.pykrakenapi
Python implementation of the Kraken API
pkgs.python314Packages.pykrakenapi
Python implementation of the Kraken API
Package maintainers
-
@TurnrDev Jay Turner <jaynicholasturner@gmail.com>
-
@Rishik-Y Rishik Yalamanchili <202301258@daiict.ac.in>
-
@nicolas-goudry Nicolas Goudry <goudry.nicolas@gmail.com>
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>