Contrast EUVD-2026-87851

Exploitation is NOT possible against a default deployment by a purely remote attacker. It requires the attacker to hold a network man-in-the-middle position on the aTLS path - either between the Contrast CLI and the Coordinator, or between the Coordinator and an attested component - AND to possess a genuine TEE machine under their physical control from which they can either forge a correctly-verifying attestation report or extract secrets. The root cause is that Contrast accepted any TEE attestation report that verified correctly and matched the expected firmware patch levels and software measurements, without binding attestation to specific physically-trusted hardware. Limiting factors: the physical-TEE-access requirement (reflected as AT:P) and the need for an active MITM position (reflected as AC:H) mean this is a targeted attack requiring a well-resourced adversary within Contrast's confidential-computing threat model; it only affects environments running Contrast before 1.16.0 for confidential workloads.

The vendor CVSS 4.0 score of 9.1 (Critical) substantially overstates real-world risk because it does not fully reward the steep compound preconditions this attack requires. The vector itself is honest about difficulty (AC:H, AT:P): although AV:N/PR:N/UI:N make it look like a trivial remote unauthenticated bug, exploitation requires the attacker to SIMULTANEOUSLY (a) hold a network man-in-the-middle position between the CLI and Coordinator, or between the Coordinator and an attested component, AND (b) already have physical control of at least one genuine TEE machine from which to forge valid reports or extract secrets. These are two independent, high-bar prerequisites that map to VulnCheck reporting via GHSA-hjgc-jc5v-fw7h rather than mass exploitation. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or automatability - no public exploit identified at time of analysis. Set against Contrast's own threat model (confidential computing exists precisely to defend against a privileged/physical adversary), this is a genuine and serious cryptographic identity-binding flaw (attestation not bound to specific trusted hardware, CWE-295), but it is a targeted, high-skill attack, not a widespread scan-and-exploit threat. Priority should be driven by whether an organization actually runs Contrast for confidential workloads, not by the 9.1 number in isolation.

An attacker who has physically compromised one Trusted Execution Environment machine (their own or a rented/seized node) extracts a correctly-verifying TEE attestation report with the expected firmware patch levels and software measurements. Positioned as a man-in-the-middle on the network path between the Contrast CLI and Coordinator, they relay that report during the attested TLS (aTLS) handshake to impersonate a legitimate Coordinator or workload, defeating identity verification and enabling interception of secrets or injection of a rogue component. No public POC is identified in the provided data; the network vector is remote but attack complexity is high due to the MITM-plus-physical-TEE requirement.