CVE-2025-58356

The record

Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.

Affected packages

Related vulnerabilities

• GO-2025-4076 Constellation has insecure LUKS2 persistent storage partitions which may be opened and… Same vulnerability
• CVE-2025-61141 sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because… Also affects govulncheck-vulndb
• CVE-2025-54471 NeuVector used a hard-coded cryptographic key embedded in the source code. Also affects govulncheck-vulndb
• CVE-2025-54470 This vulnerability affects NeuVector deployments only when the Report anonymous cluster… Also affects govulncheck-vulndb
• CVE-2025-54469 A vulnerability was identified in NeuVector, where the enforcer used environment… Also affects govulncheck-vulndb
• CVE-2024-58269 A vulnerability has been identified in Rancher Manager, where sensitive information… Also affects govulncheck-vulndb
• CVE-2023-32199 A vulnerability has been identified within Rancher Manager, where after removing a custom… Also affects govulncheck-vulndb
• CVE-2025-64101 ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection Also affects govulncheck-vulndb