Edgelesssys Contrast
14 CVEs affecting Edgelesssys Contrast. Latest disclosed: 2026-10-25. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100833 | Critical | 9.6 | 2026-09-27 | Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase dur… |
CVE-2026-100839 | High | 8.4 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection… |
CVE-2026-100838 | High | 8.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw… |
CVE-2026-109358 | High | 7.8 | 2026-10-12 | Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writa… |
CVE-2026-109359 | High | 7.7 | 2026-10-12 | Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same… |
CVE-2026-100835 | High | 7.4 | 2026-09-27 | Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained t… |
CVE-2025-71425 | High | 7.3 | 2026-09-27 | Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONT… |
CVE-2025-71423 | High | 7.3 | 2026-09-27 | Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response —… |
CVE-2025-71426 | High | 7.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recove… |
CVE-2025-71422 | Medium | 5.7 | 2026-09-27 | Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host… |
CVE-2026-100836 | Medium | 4.3 | 2026-09-27 | Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decod… |
CVE-2026-100837 | Low | 3.7 | 2026-09-27 | Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor… |
CVE-2025-71424 | Low | 3.5 | 2026-09-27 | Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Doc… |
CVE-2026-116197 | Low | 2.6 | 2026-10-25 | Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration… |