Edgeless Contrast CVE-2025-71426

Exploitation requires THREE conditions to coincide: (1) the attacker must be able to redirect network traffic from the legitimate Contrast Coordinator to an attacker-run rogue Coordinator (a man-in-the-middle / network-position prerequisite, not remote-from-anywhere); (2) the attacker stands up a rogue Coordinator whose manifest passes validation but uses an attacker-controlled recovery seed (the flaw is that recovery does not verify the supplied seed); and (3) a workload owner must perform an action - either set a new manifest without comparing the returned root CA certificate to the existing one (the DEFAULT behavior of the contrast CLI) or verify the Coordinator without comparing its root CA against a trusted reference. Exploitation is LIMITED to recovering secrets of workloads deployed AFTER the attack; the legitimate Coordinator's seed, CA, and workload secrets, workload integrity, and mesh-CA-chained certificates are not affected. The workaround - pinning the CA cert on first set and comparing bit-for-bit on later calls - fully neutralizes the flaw. Affected versions: Contrast <= 1.4.0, fixed in 1.4.1.

This is a genuine but conditional integrity/confidentiality flaw, not a widespread emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N) yields 7.1 (High) and correctly captures that no attacker privileges are needed (PR:N) but user interaction is (UI:P) - a workload owner must perform a set/verify operation. Critically, the vector understates a major real-world limiter: successful attack REQUIRES the attacker to already redirect network traffic from the legitimate Coordinator to a rogue one (a MITM/network-position prerequisite), which realistically raises attack complexity beyond AC:L. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so the exploitation signal is 'no public exploit identified at time of analysis.' Impact is bounded: only workloads deployed AFTER the attack can have secrets recovered, and the legitimate Coordinator's seed/CA/workload secrets and workload integrity remain intact. Net: a real defense-in-depth priority for the small population that runs Contrast, but the combination of required network redirection, required victim action, and the default-but-avoidable CLI behavior keeps real-world exploitability modest rather than critical.

An attacker who can redirect Kubernetes network traffic (e.g., via a compromised in-cluster network position or DNS/routing manipulation) stands up a rogue Contrast Coordinator loaded with a manifest that passes validation but seeded with an attacker-controlled secret. When a workload owner runs the default contrast set (or verify) and does not manually compare the returned root CA certificate against a trusted reference, they trust the rogue Coordinator, which then issues certificates chaining to its own root CA and recovers secrets of workloads deployed after the attack. No public proof-of-concept was identified in the provided intelligence.