CVE-2026-116197: falha de baixa gravidade em edgelesssys contrast
Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.1epss 0.2%
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
edgelesssys · contrastCVEs relacionadas — edgelesssys contrast
No mesmo produto, das mais perigosas para as menos.
CVE-2026-100835CRITICALContrast before 1.16.0 Remote Attestation Relay AttackEPSS 0.3%CVE-2026-100833HIGHContrast before 1.23.1 Image Substitution via Policy GenerationEPSS 0.2%CVE-2026-100838HIGHContrast before 1.19.1 CopyFile Policy Symlink SubversionEPSS 0.2%CVE-2026-100837MEDIUMEdgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix MatchingEPSS 0.2%CVE-2025-71423HIGHEdgelesssys Contrast before 1.12.2 Workload Secrets Information DisclosureEPSS 0.2%CVE-2025-71425HIGHContrast before 1.8.1 Information Disclosure via LoggingEPSS 0.2%