Edgeless Contrast EUVD-2026-87853

Exploitation requires that the target run Contrast (edgelesssys/contrast) version 1.14.0 up to but not including 1.23.1, using Kata Containers confidential containers whose runtime policies were generated by the vulnerable code. The specific trigger is a storage entry that uses the image_guest_pull driver - the flawed allow_storage policy rule accepts such entries WITHOUT verifying the image digest. The attacker must have access to the Kata agent API (in Contrast's threat model this is a Kubernetes cluster administrator), and the substituted malicious image must still satisfy all remaining runtime policy rules. Limiting factors that reduce realistic risk: the attacker needs a privileged position reaching the Kata agent API rather than anonymous remote access, exploitation is non-automatable (SSVC), and only confidential-container workloads relying on Contrast's policy-based image integrity are affected; default conventional Kubernetes workloads are out of scope.

Signals are consistent and point to a serious-but-not-emergency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and SSVC 'Technical Impact: total' agree that a low-privileged actor with network reach to the Kata agent API can fully undermine the confidential container's integrity. However, exploitation signals are all low: EPSS is 0.23% (12th percentile), SSVC Exploitation is 'none', SSVC Automatable is 'no', there is no CISA KEV listing, and no public exploit code was identified. These low exploitation signals are expected and partially misleading for this class of flaw: the attacker in Contrast's threat model is a Kubernetes cluster administrator - a privileged insider who already controls the untrusted infrastructure - so this is deliberately NOT a mass-scannable internet vulnerability, which explains the low EPSS/automatable signals despite the high technical impact. The real-world priority is therefore HIGH for the specific population running Contrast confidential containers (the entire security value proposition - integrity of confidential workloads against a malicious host/admin - is defeated), but LOW as a broad fleet-wide threat. One point to verify: PR:L is somewhat generous given the attacker must reach the privileged Kata agent API; this reflects Contrast's inverted trust model (infrastructure is untrusted) rather than a conventional authenticated-user prerequisite.

A malicious or compromised Kubernetes cluster administrator with access to the Kata agent API crafts a storage entry using the image_guest_pull driver and swaps a legitimate confidential-container image for an exploit payload. Because the generated runtime policy's flawed allow_storage rule does not verify the image digest for that driver, the substitution passes policy validation as long as the replacement image satisfies the remaining rules, letting attacker-controlled code run inside the supposedly attested confidential container. No public exploit code or active exploitation has been identified; exploitation requires the privileged insider position defined in Contrast's threat model.