CVE-2026-116197: low-severity vulnerability in edgelesssys contrast
Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.1epss 0.2%
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
edgelesssys · contrastRelated CVEs — edgelesssys contrast
In the same product, most dangerous first.
CVE-2026-100835CRITICALContrast before 1.16.0 Remote Attestation Relay AttackEPSS 0.3%CVE-2026-100833HIGHContrast before 1.23.1 Image Substitution via Policy GenerationEPSS 0.2%CVE-2026-100838HIGHContrast before 1.19.1 CopyFile Policy Symlink SubversionEPSS 0.2%CVE-2026-100837MEDIUMEdgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix MatchingEPSS 0.2%CVE-2025-71423HIGHEdgelesssys Contrast before 1.12.2 Workload Secrets Information DisclosureEPSS 0.2%CVE-2025-71425HIGHContrast before 1.8.1 Information Disclosure via LoggingEPSS 0.2%