Edgeless Contrast CVE-2026-109359

Exploitation specifically requires the attacker to hold WRITE access to the Coordinator's manifest history, and targets the peer-recovery path that fails to confirm the serving peer uses the same manifest generation. The primary outcome (withdrawn workloads obtaining trusted mesh certificates) requires replaying a superseded history head; the more severe outcome (Mesh CA key disclosure) additionally requires possession of the secret seed. LIMITING FACTORS: this is not remotely reachable without privilege - the CVSS vector encodes PR:H (manifest-history write access) and AT:P (a specific transient/configuration state must hold, such as a replayable superseded head), so default, fully-patched or properly-isolated deployments without attacker manifest-write access are not exploitable; no user interaction is needed (UI:N). Affected only in Contrast versions 1.8.0 up to but not including 1.24.1.

This is a serious-but-conditional confidentiality/integrity flaw rather than a mass-exploitation threat. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, base 8.7 High) tells a consistent story: the attack is network-reachable (AV:N) but gated by two significant limiters - high privileges (PR:H, i.e. write access to Contrast's manifest history) and a present attack requirement (AT:P, a specific transient state such as a superseded history head being replayable or the secret seed being available). The high vulnerable-system and subsequent-system impacts (VC:H/VI:H and SC:H/SI:H) reflect that success yields trusted mesh certificates for withdrawn workloads or disclosure of the Mesh CA key - a trust-anchor compromise that cascades across the mesh. There is NO EPSS score, NO CISA KEV listing, and NO POC referenced in the provided data, so the correct exploitation status is 'no public exploit identified at time of analysis.' The PR:H prerequisite means this is not an unauthenticated internet-facing issue; realistic risk is concentrated in insider/compromised-operator scenarios or post-compromise lateral trust abuse. Conflict to verify: the vector encodes PR:H (privileged attacker with manifest-history write access), yet the product is a confidential-computing platform where that privilege is precisely what Contrast's attestation model assumes the attacker does NOT reliably have - treat the PR:H boundary as the key risk hinge and confirm it against the edgelesssys advisory.

An attacker who already holds write access to the Coordinator's manifest history replays a superseded history head during a peer-recovery exchange; because the serving peer's manifest generation is not confirmed to match, a previously withdrawn workload is handed valid, trusted mesh certificates and rejoins the confidential mesh as a legitimate member. In the more severe variant, an attacker additionally possessing the secret seed uses the same verification gap to disclose the Mesh CA private key, compromising the trust anchor for the entire deployment. No public exploit code is referenced in the available data, and the attack requires the AT:P transient condition plus the PR:H privilege level encoded in the CVSS vector.