Edgeless Systems Contrast EUVD-2025-211009

Exploitation requires an authenticated Kubernetes principal (user or service account) that holds get or list permission on the pods/logs subresource in the namespace running Contrast, and a Contrast deployment on an affected version (1.9.0 through 1.12.1) with initializer logging enabled at INFO level (the default). No special attacker tooling, user interaction, or non-default configuration is needed beyond that RBAC permission. Limiting factors: the attacker must already possess in-cluster log-read RBAC (PR:L), the product is narrowly deployed, and versions 1.8.1 and earlier as well as 1.12.2+ are not affected. The vendor workaround is to reinitialize Contrast from scratch (existing secrets are compromised) and disable logging.

This is a credible operational priority within its niche, but not a mass-exploitation threat. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, score 8.5) indicates an authenticated actor (PR:L) with low complexity and no user interaction can achieve high confidentiality and integrity impact. The core issue is confirmed by the vendor GHSA and source diff: the initializer logged the full NewMeshCert response (including the workload secret) at INFO level, exposing secrets to any Kubernetes principal with get/list on pods/logs. No EPSS score is provided, there is no CISA KEV listing, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis.' The realistic risk is amplified by the fact that this is a REGRESSION of a previously-fixed flaw (GHSA-h5f8-crrq-4pw8), meaning the exposure window spans all releases 1.9.0 through 1.12.1. One signal to scrutinize: the vendor rated AV:A (Adjacent), yet pods/logs are read through the Kubernetes API server, which is typically network-reachable - a case for AV:N. Also, the direct primitive is information disclosure (confidentiality); the VI:H/high-integrity rating is derivative, resting on the fact that leaked workload secrets underpin encrypted storage and Vault integration and thus enable downstream integrity compromise. Overall: real and worth prompt remediation for Contrast operators, but bounded by the required in-cluster RBAC privilege and the product's small deployment footprint.

An attacker or curious insider who holds a Kubernetes service account or user with get/list permission on pods/logs reads the initializer pod's logs and harvests the workload secret printed at INFO level. Because that secret keys encrypted storage and Vault integration, the attacker can then decrypt persisted data and access Vault-backed secrets, and those secrets must be treated as fully compromised. No public exploit code is required - the secret is plainly visible in standard log output.