Log in Start free

Vulnerability · Published Oct 27, 2025 · Assigned by GitHub_M

CVE-2025-58356Constellation allows insecure use of LUKS2 persistent storage partitions

High 8.3

In plain English

A high-severity security flaw in constellation from edgelesssys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High
Exploit odds (30 days)0.1%top 98.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/edgelesssys/constellationno fix listedGO-2025-4076
Gogithub.com/edgelesssys/constellation/v22.24.0GHSA-hq76-6gh2-5g4q
Gogithub.com/edgelesssys/constellation/v22.24.0GO-2025-4076

Affected products (as reported)

VendorProductVersions
edgelesssys constellation < 2.24.0

Weakness: CWE-347 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References