Contrast versions prior to 1.12.1 use cryptsetup for secure persistent volumes but are vulnerable to crafted LUKS2 volumes that use null key-encryption algorithms. This allows an attacker to create volumes that open without error and record data in plaintext or with attacker-known keys, exposing confidential data. A partial fix was introduced in cryptsetup 2.8.1 and incorporated in Contrast v1.12.1. Further hardening and integrity protection were added in Contrast v1.13.0.