Edgeless Systems Contrast CVE-2026-116197

Two specific prerequisites must BOTH hold, per the vendor advisory: (1) the imagepuller pull configuration must list both a concrete domain and its parent domain as a wildcard (e.g. 'registry.example.com' alongside '.example.com'); and (2) the wildcard entry's configuration - registry credentials, CA bundle, or mirror settings - must be unsuitable for the concrete registry. Exploitation is further limited to the 'workload operator' persona, and the metadata/mirror leak only matters if the audience permitted for the wildcard is positioned to attack the image pull at the network level (AV:A adjacent). The vendor explicitly states such overlapping configurations are very unlikely to exist in practice, since a root wildcard carrying credentials would itself be a risky setup. The flaw does not affect default configurations lacking overlapping concrete/wildcard registry entries.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor CVSS 4.0 score is 2.1 (Low) with AV:A/AC:H/AT:P/PR:L - adjacent vector, high complexity, a present attack requirement, and low privileges - and only a Low confidentiality impact (VC:L) with no integrity or availability impact. The vuln.today decision label is 'monitor', not act_now or emergency. There is no CISA KEV listing and no EPSS value supplied, so widespread exploitation probability cannot be quantified from the input but nothing suggests urgency. No public exploit code is referenced (only the GHSA and VulnCheck advisories, which are not PoC/exploit references). Critically, the vendor's own advisory states the triggering configuration is 'very unlikely to exist in practice' and that the advisory is relevant only to workload operators, not external attackers. The combined picture - low CVSS, monitor decision, no KEV/PoC, and a self-described improbable prerequisite - indicates this is a correctness/defense-in-depth fix rather than an actively dangerous flaw. The one caveat to verify: the impact is a credential/metadata leak, which can matter more than a 2.1 score implies if a high-value wildcard credential is involved, so operators using wildcard registry credentials should still patch.

A workload operator configures Contrast's imagepuller pull configuration with both a concrete registry (e.g. registry.example.com) and a parent wildcard (.example.com) whose credentials, CA bundle, or mirror settings are not appropriate for the concrete registry. Due to non-deterministic selection preferring the wildcard, the wildcard's credentials or pull metadata are applied to the concrete registry and leaked to the audience permitted for the wildcard - but only if that audience is positioned to attack the pull at the network level. No public exploit code is identified at time of analysis, and the vendor notes such a configuration is very unlikely in practice.