11 New Kubernetes Vulnerabilities - 1 Critical, 10 High Severity

Remote attestation relay in Edgeless Systems Contrast before 1.16.0 allows an attacker to impersonate a Contrast Coordinator or a Contrast workload and defeat attested TLS (aTLS) identity verification. Contrast accepted any TEE attestation report that verified correctly and matched expected firmware patch levels and software measurements, without binding that attestation to specific, physically-trusted hardware, so a valid report captured from one machine can be replayed to stand in for another. Per the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and this is not exploitable against a default deployment by a purely remote attacker: it requires a network man-in-the-middle position on the aTLS path plus a genuine TEE machine under the attacker's physical control. The vendor's CVSS 4.0 score of 9.1 (Critical) substantially overstates real-world risk because it does not fully reward the steep compound preconditions this attack requires.

Malicious Kubernetes hosts can read confidential data written to Contrast secure persistent volumes by supplying a crafted LUKS2 block device that the pod VM wrongly accepts as encrypted. The flaw affects Contrast (Go module github.com/edgelesssys/contrast) through 1.12.0 when the opt-in secure persistent volume feature is enabled and the guest bundles cryptsetup older than 2.8.1: LUKS2 metadata is unauthenticated and a header declaring the cipher_null-ecb null keyslot algorithm is accepted without error, so the Initializer assumes the device is protected when 'cryptsetup open' succeeds and writes secrets to a volume that is plaintext or keyed with an attacker-known volume key. Exploitation requires host-level provisioning privilege (CVSS 4.0 AV:A/AC:L/PR:L/UI:N, confidentiality-only; independent assessment CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the adversary is a malicious or compromised infrastructure operator rather than a conventional remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is closed by Contrast 1.12.1, which ships cryptsetup 2.8.1, and further hardened by 1.13.0.

Credential leakage in Edgeless Systems Contrast through 1.20.0 stems from unanchored suffix matching in the imagepuller's per-registry configuration lookup, which allows a registry block defined for one FQDN to be applied to any hostname merely ending in that same byte sequence. When a deployment pulls an image from a sibling domain such as evilghcr.io that an attacker has registered (or that appears coincidentally in the pull path), the imagepuller transmits the configured Authorization header - basic auth, registry token, or identity token - and additionally inherits the host's custom CA bundle, mirror setting, and insecure-skip-verify behavior, disabling TLS verification for that host. The CVSS 4.0 base score is 6.3 (our independent assessment scores it 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), and the vector requires no privileges (PR:N) but is rated high-complexity because two independent preconditions must align: a per-registry FQDN configured without a leading dot, and an image pulled from a matching suffix domain. There is no public exploit identified at time of analysis and no KEV listing; the issue is best treated as configuration hygiene, and configuration entries that use a leading dot (for example [registries.".example.registry"]) are entirely unaffected.

Authenticated workloads that hold a valid mesh certificate can force a recovered runtime panic in the Edgeless Contrast Coordinator's transit-engine endpoint (all versions through 1.20.0) by submitting a 'vault:vX:base64' ciphertext whose third component decodes to fewer than 12 bytes. The panic is caught by net/http and returned as a 500, so the process survives, but each trigger aborts the request mid-handler and writes the recovered panic to the Coordinator logs, producing log spam, request-failure metrics, and a cheap, low-rate degradation of the transit-engine API. Reachability is gated by mesh-certificate authentication (CVSS 4.0 base 5.3, AV:N/PR:L, availability-only), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor fix is available in 1.21.0, making this a low-priority hardening item rather than an urgent one.

Contrast versions up to and including 1.9.0 allow the untrusted host underlying a bare-metal confidential container deployment to write arbitrary file trees below a container's VOLUME mount point, compromising the integrity of a directory that is typically central to the application's core functionality. The weakness occurs because containerd auto-creates a mount point for any OCI config.volumes entry that Kubernetes does not explicitly mount, forcing the runtime to relay host-supplied content to the Kata agent; only integrity of that path is affected, with no confidentiality or availability impact. It is rated low severity (CVSS 4.0 5.1; assessed CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), affects bare-metal deployments only (Azure AKS is explicitly unaffected), and no public exploit code was identified at time of analysis; a vendor fix is available in 1.9.1.