Contrast
Monthly
Improper verification in the Edgeless Systems Contrast Coordinator's peer-recovery path (versions 1.8.0 through 1.24.0) lets an authenticated actor who holds write access to the Coordinator's manifest history replay a superseded history head, because the recovering peer never confirms that the serving peer is on the same manifest generation. Successful replay can cause withdrawn workloads to receive trusted mesh certificates, and an attacker who additionally possesses the secret seed can disclose the Mesh CA key; the flaw is conditional rather than mass-exploitable, requiring PR:H privileges plus a specific transient/replayable state (AT:P), and no public exploit has been identified at time of analysis. Patched versions of Contrast (1.24.1 and later) address the missing generation check.
Local privilege escalation in Edgeless Systems Contrast 1.8.0 through 1.24.0 allows a low-privileged local user on a node to modify the world-writable containerd configuration and overwrite the runc runtime path, leading to high confidentiality, integrity, and availability impact on that node. This is a credible local privilege-escalation issue rather than a remotely wormable threat; the CVSS vector requires local access with low privileges (PR:L), and no public exploit identified at time of analysis.
Host-controlled AML injection in Edgeless Systems' Contrast confidential-computing runtime before 1.18.0 lets an adversary who controls the QEMU host achieve arbitrary code execution inside AMD SEV-SNP guest VMs, including reads and writes to private memory pages that the confidential-computing model is supposed to shield. Only the Metal-QEMU-SNP and Metal-QEMU-SNP-GPU platforms are affected; Metal-QEMU-TDX is not, because OVMF measures ACPI table contents into RTMR 0 on Intel TDX. The flaw is rated CVSS 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) via the host-to-guest trust boundary, carries no CISA KEV status and no public exploit code identified at time of analysis, and is fixed in Contrast 1.18.0, which sandboxes the kernel AML interpreter; the underlying BadAML technique is publicly documented in academic and Black Hat EU 2024 research, and the weakness is generic to Confidential Computing deployments that expose the ACPI interface to the host.
Arbitrary writes to the guest root filesystem in Edgeless Systems' Contrast confidential-computing runtime before 1.19.1 allow a malicious process on the untrusted Kubernetes host to achieve full guest takeover. The flaw lives in the Kata agent policies generated by the Contrast CLI: the CopyFile verification does not correctly resolve symlinks (CWE-59), so an attacker who can open a VSOCK connection to the Kata agent can chain CopyFile requests to overwrite security-critical files inside the guest or trick the workload into disclosing sensitive data. The vendor (via VulnCheck) scores this CVSS 4.0 8.6 (High), and an independent assessment concurs that it is a genuine confidentiality-and-integrity break (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) rather than a high-score paper cut. Exploitation is not reachable over a standard network - the attacker must already hold a foothold on the untrusted host, which is precisely the adversary model Contrast assumes - and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Remote attestation relay in Edgeless Systems Contrast before 1.16.0 allows an attacker to impersonate a Contrast Coordinator or a Contrast workload and defeat attested TLS (aTLS) identity verification. Contrast accepted any TEE attestation report that verified correctly and matched expected firmware patch levels and software measurements, without binding that attestation to specific, physically-trusted hardware, so a valid report captured from one machine can be replayed to stand in for another. Per the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and this is not exploitable against a default deployment by a purely remote attacker: it requires a network man-in-the-middle position on the aTLS path plus a genuine TEE machine under the attacker's physical control. The vendor's CVSS 4.0 score of 9.1 (Critical) substantially overstates real-world risk because it does not fully reward the steep compound preconditions this attack requires.
Container image substitution in Edgeless Contrast 1.14.0 through 1.23.0 lets an attacker who can reach the Kata agent API - in Contrast's threat model, a Kubernetes cluster administrator - swap a workload's container image for an exploit payload and thereby break the integrity guarantees of the confidential container. The root cause is a runtime-policy generation bug: a misplaced allow_storage rule introduced by a bad rebase during a Kata Containers update accepts storage entries using the image_guest_pull driver without verifying the image digest. No public exploit code has been identified at time of analysis and EPSS is low at 0.23% (12th percentile), but exploitation is authenticated (CVSS PR:L), non-automatable per SSVC, and gated on the substituted image still satisfying all remaining policy rules; technical impact is rated total.
Coordinator impersonation in Edgeless Systems Contrast (a confidential-computing runtime for Kubernetes) before version 1.4.1 lets an attacker who can redirect traffic to a rogue Coordinator recover arbitrary secrets of workloads deployed after the attack. The recovering Coordinator fails to verify the seed supplied by the recovering party, so a rogue Coordinator whose manifest passes validation but whose secret seed is attacker-controlled can issue certificates chaining to its own root CA, impersonating a workload owner when the `contrast` CLI `set` call does not compare the returned root CA certificate against the existing one (the CLI's default behavior) or when `verify` is run without comparing against a trusted reference. Exploitation is unauthenticated but conditional - it requires a network-position/man-in-the-middle prerequisite plus a victim workload-owner action - so this is a genuine but conditional integrity and confidentiality flaw rather than a widespread emergency; no public exploit is identified at time of analysis and the issue is not in CISA KEV.
Workload secrets managed by Edgeless Systems' Contrast confidential-computing platform are written to Kubernetes pod logs, letting anyone with log-read access recover secrets that are meant to be visible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner. All Contrast releases up to and including 1.8.0 are affected whenever the Contrast initializer runs at the default CONTRAST_LOG_LEVEL of info (the same leak also occurs at debug), so installations that never customized the initializer log level are exposed by default; deployments that do not use workload secrets at all are unaffected. Recovering the leaked value requires low-privileged access - Kubernetes get or list permission on pods/logs (PR:L in the assessed vector) or read access to the underlying Kubernetes log storage - this is a passive confidentiality disclosure with no code execution, and no public exploit has been identified at time of analysis.
Workload secrets are written to the initializer's standard output at INFO level in Edgeless Systems Contrast versions 1.9.0 through 1.12.1, so any Kubernetes principal that holds get or list permission on the pods/logs subresource in the affected namespace can read them from the container log stream. Because those workload secrets back Contrast's encrypted storage and HashiCorp Vault integration, the storage keys and Vault credentials derived from them must also be treated as compromised, giving the attacker a path to decrypt protected data and reach Vault-backed secrets. The flaw is a regression of GHSA-h5f8-crrq-4pw8 (originally fixed in 1.8.1 but never ported to the main branch), patchable in 1.12.2; there is no public exploit identified at time of analysis and no KEV listing, so risk is driven by the low barrier of an existing log-read RBAC grant rather than by active exploitation.
Credential leakage in Edgeless Systems Contrast through 1.20.0 stems from unanchored suffix matching in the imagepuller's per-registry configuration lookup, which allows a registry block defined for one FQDN to be applied to any hostname merely ending in that same byte sequence. When a deployment pulls an image from a sibling domain such as evilghcr.io that an attacker has registered (or that appears coincidentally in the pull path), the imagepuller transmits the configured Authorization header - basic auth, registry token, or identity token - and additionally inherits the host's custom CA bundle, mirror setting, and insecure-skip-verify behavior, disabling TLS verification for that host. The CVSS 4.0 base score is 6.3 (our independent assessment scores it 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), and the vector requires no privileges (PR:N) but is rated high-complexity because two independent preconditions must align: a per-registry FQDN configured without a leading dot, and an image pulled from a matching suffix domain. There is no public exploit identified at time of analysis and no KEV listing; the issue is best treated as configuration hygiene, and configuration entries that use a leading dot (for example [registries.".example.registry"]) are entirely unaffected.
Authenticated workloads that hold a valid mesh certificate can force a recovered runtime panic in the Edgeless Contrast Coordinator's transit-engine endpoint (all versions through 1.20.0) by submitting a 'vault:vX:base64' ciphertext whose third component decodes to fewer than 12 bytes. The panic is caught by net/http and returned as a 500, so the process survives, but each trigger aborts the request mid-handler and writes the recovered panic to the Coordinator logs, producing log spam, request-failure metrics, and a cheap, low-rate degradation of the transit-engine API. Reachability is gated by mesh-certificate authentication (CVSS 4.0 base 5.3, AV:N/PR:L, availability-only), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor fix is available in 1.21.0, making this a low-priority hardening item rather than an urgent one.
Contrast versions up to and including 1.9.0 allow the untrusted host underlying a bare-metal confidential container deployment to write arbitrary file trees below a container's VOLUME mount point, compromising the integrity of a directory that is typically central to the application's core functionality. The weakness occurs because containerd auto-creates a mount point for any OCI config.volumes entry that Kubernetes does not explicitly mount, forcing the runtime to relay host-supplied content to the Kata agent; only integrity of that path is affected, with no confidentiality or availability impact. It is rated low severity (CVSS 4.0 5.1; assessed CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), affects bare-metal deployments only (Azure AKS is explicitly unaffected), and no public exploit code was identified at time of analysis; a vendor fix is available in 1.9.1.
Malicious Kubernetes hosts can read confidential data written to Contrast secure persistent volumes by supplying a crafted LUKS2 block device that the pod VM wrongly accepts as encrypted. The flaw affects Contrast (Go module github.com/edgelesssys/contrast) through 1.12.0 when the opt-in secure persistent volume feature is enabled and the guest bundles cryptsetup older than 2.8.1: LUKS2 metadata is unauthenticated and a header declaring the cipher_null-ecb null keyslot algorithm is accepted without error, so the Initializer assumes the device is protected when 'cryptsetup open' succeeds and writes secrets to a volume that is plaintext or keyed with an attacker-known volume key. Exploitation requires host-level provisioning privilege (CVSS 4.0 AV:A/AC:L/PR:L/UI:N, confidentiality-only; independent assessment CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the adversary is a malicious or compromised infrastructure operator rather than a conventional remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is closed by Contrast 1.12.1, which ships cryptsetup 2.8.1, and further hardened by 1.13.0.
Improper verification in the Edgeless Systems Contrast Coordinator's peer-recovery path (versions 1.8.0 through 1.24.0) lets an authenticated actor who holds write access to the Coordinator's manifest history replay a superseded history head, because the recovering peer never confirms that the serving peer is on the same manifest generation. Successful replay can cause withdrawn workloads to receive trusted mesh certificates, and an attacker who additionally possesses the secret seed can disclose the Mesh CA key; the flaw is conditional rather than mass-exploitable, requiring PR:H privileges plus a specific transient/replayable state (AT:P), and no public exploit has been identified at time of analysis. Patched versions of Contrast (1.24.1 and later) address the missing generation check.
Local privilege escalation in Edgeless Systems Contrast 1.8.0 through 1.24.0 allows a low-privileged local user on a node to modify the world-writable containerd configuration and overwrite the runc runtime path, leading to high confidentiality, integrity, and availability impact on that node. This is a credible local privilege-escalation issue rather than a remotely wormable threat; the CVSS vector requires local access with low privileges (PR:L), and no public exploit identified at time of analysis.
Host-controlled AML injection in Edgeless Systems' Contrast confidential-computing runtime before 1.18.0 lets an adversary who controls the QEMU host achieve arbitrary code execution inside AMD SEV-SNP guest VMs, including reads and writes to private memory pages that the confidential-computing model is supposed to shield. Only the Metal-QEMU-SNP and Metal-QEMU-SNP-GPU platforms are affected; Metal-QEMU-TDX is not, because OVMF measures ACPI table contents into RTMR 0 on Intel TDX. The flaw is rated CVSS 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) via the host-to-guest trust boundary, carries no CISA KEV status and no public exploit code identified at time of analysis, and is fixed in Contrast 1.18.0, which sandboxes the kernel AML interpreter; the underlying BadAML technique is publicly documented in academic and Black Hat EU 2024 research, and the weakness is generic to Confidential Computing deployments that expose the ACPI interface to the host.
Arbitrary writes to the guest root filesystem in Edgeless Systems' Contrast confidential-computing runtime before 1.19.1 allow a malicious process on the untrusted Kubernetes host to achieve full guest takeover. The flaw lives in the Kata agent policies generated by the Contrast CLI: the CopyFile verification does not correctly resolve symlinks (CWE-59), so an attacker who can open a VSOCK connection to the Kata agent can chain CopyFile requests to overwrite security-critical files inside the guest or trick the workload into disclosing sensitive data. The vendor (via VulnCheck) scores this CVSS 4.0 8.6 (High), and an independent assessment concurs that it is a genuine confidentiality-and-integrity break (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) rather than a high-score paper cut. Exploitation is not reachable over a standard network - the attacker must already hold a foothold on the untrusted host, which is precisely the adversary model Contrast assumes - and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Remote attestation relay in Edgeless Systems Contrast before 1.16.0 allows an attacker to impersonate a Contrast Coordinator or a Contrast workload and defeat attested TLS (aTLS) identity verification. Contrast accepted any TEE attestation report that verified correctly and matched expected firmware patch levels and software measurements, without binding that attestation to specific, physically-trusted hardware, so a valid report captured from one machine can be replayed to stand in for another. Per the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and this is not exploitable against a default deployment by a purely remote attacker: it requires a network man-in-the-middle position on the aTLS path plus a genuine TEE machine under the attacker's physical control. The vendor's CVSS 4.0 score of 9.1 (Critical) substantially overstates real-world risk because it does not fully reward the steep compound preconditions this attack requires.
Container image substitution in Edgeless Contrast 1.14.0 through 1.23.0 lets an attacker who can reach the Kata agent API - in Contrast's threat model, a Kubernetes cluster administrator - swap a workload's container image for an exploit payload and thereby break the integrity guarantees of the confidential container. The root cause is a runtime-policy generation bug: a misplaced allow_storage rule introduced by a bad rebase during a Kata Containers update accepts storage entries using the image_guest_pull driver without verifying the image digest. No public exploit code has been identified at time of analysis and EPSS is low at 0.23% (12th percentile), but exploitation is authenticated (CVSS PR:L), non-automatable per SSVC, and gated on the substituted image still satisfying all remaining policy rules; technical impact is rated total.
Coordinator impersonation in Edgeless Systems Contrast (a confidential-computing runtime for Kubernetes) before version 1.4.1 lets an attacker who can redirect traffic to a rogue Coordinator recover arbitrary secrets of workloads deployed after the attack. The recovering Coordinator fails to verify the seed supplied by the recovering party, so a rogue Coordinator whose manifest passes validation but whose secret seed is attacker-controlled can issue certificates chaining to its own root CA, impersonating a workload owner when the `contrast` CLI `set` call does not compare the returned root CA certificate against the existing one (the CLI's default behavior) or when `verify` is run without comparing against a trusted reference. Exploitation is unauthenticated but conditional - it requires a network-position/man-in-the-middle prerequisite plus a victim workload-owner action - so this is a genuine but conditional integrity and confidentiality flaw rather than a widespread emergency; no public exploit is identified at time of analysis and the issue is not in CISA KEV.
Workload secrets managed by Edgeless Systems' Contrast confidential-computing platform are written to Kubernetes pod logs, letting anyone with log-read access recover secrets that are meant to be visible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner. All Contrast releases up to and including 1.8.0 are affected whenever the Contrast initializer runs at the default CONTRAST_LOG_LEVEL of info (the same leak also occurs at debug), so installations that never customized the initializer log level are exposed by default; deployments that do not use workload secrets at all are unaffected. Recovering the leaked value requires low-privileged access - Kubernetes get or list permission on pods/logs (PR:L in the assessed vector) or read access to the underlying Kubernetes log storage - this is a passive confidentiality disclosure with no code execution, and no public exploit has been identified at time of analysis.
Workload secrets are written to the initializer's standard output at INFO level in Edgeless Systems Contrast versions 1.9.0 through 1.12.1, so any Kubernetes principal that holds get or list permission on the pods/logs subresource in the affected namespace can read them from the container log stream. Because those workload secrets back Contrast's encrypted storage and HashiCorp Vault integration, the storage keys and Vault credentials derived from them must also be treated as compromised, giving the attacker a path to decrypt protected data and reach Vault-backed secrets. The flaw is a regression of GHSA-h5f8-crrq-4pw8 (originally fixed in 1.8.1 but never ported to the main branch), patchable in 1.12.2; there is no public exploit identified at time of analysis and no KEV listing, so risk is driven by the low barrier of an existing log-read RBAC grant rather than by active exploitation.
Credential leakage in Edgeless Systems Contrast through 1.20.0 stems from unanchored suffix matching in the imagepuller's per-registry configuration lookup, which allows a registry block defined for one FQDN to be applied to any hostname merely ending in that same byte sequence. When a deployment pulls an image from a sibling domain such as evilghcr.io that an attacker has registered (or that appears coincidentally in the pull path), the imagepuller transmits the configured Authorization header - basic auth, registry token, or identity token - and additionally inherits the host's custom CA bundle, mirror setting, and insecure-skip-verify behavior, disabling TLS verification for that host. The CVSS 4.0 base score is 6.3 (our independent assessment scores it 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), and the vector requires no privileges (PR:N) but is rated high-complexity because two independent preconditions must align: a per-registry FQDN configured without a leading dot, and an image pulled from a matching suffix domain. There is no public exploit identified at time of analysis and no KEV listing; the issue is best treated as configuration hygiene, and configuration entries that use a leading dot (for example [registries.".example.registry"]) are entirely unaffected.
Authenticated workloads that hold a valid mesh certificate can force a recovered runtime panic in the Edgeless Contrast Coordinator's transit-engine endpoint (all versions through 1.20.0) by submitting a 'vault:vX:base64' ciphertext whose third component decodes to fewer than 12 bytes. The panic is caught by net/http and returned as a 500, so the process survives, but each trigger aborts the request mid-handler and writes the recovered panic to the Coordinator logs, producing log spam, request-failure metrics, and a cheap, low-rate degradation of the transit-engine API. Reachability is gated by mesh-certificate authentication (CVSS 4.0 base 5.3, AV:N/PR:L, availability-only), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor fix is available in 1.21.0, making this a low-priority hardening item rather than an urgent one.
Contrast versions up to and including 1.9.0 allow the untrusted host underlying a bare-metal confidential container deployment to write arbitrary file trees below a container's VOLUME mount point, compromising the integrity of a directory that is typically central to the application's core functionality. The weakness occurs because containerd auto-creates a mount point for any OCI config.volumes entry that Kubernetes does not explicitly mount, forcing the runtime to relay host-supplied content to the Kata agent; only integrity of that path is affected, with no confidentiality or availability impact. It is rated low severity (CVSS 4.0 5.1; assessed CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), affects bare-metal deployments only (Azure AKS is explicitly unaffected), and no public exploit code was identified at time of analysis; a vendor fix is available in 1.9.1.
Malicious Kubernetes hosts can read confidential data written to Contrast secure persistent volumes by supplying a crafted LUKS2 block device that the pod VM wrongly accepts as encrypted. The flaw affects Contrast (Go module github.com/edgelesssys/contrast) through 1.12.0 when the opt-in secure persistent volume feature is enabled and the guest bundles cryptsetup older than 2.8.1: LUKS2 metadata is unauthenticated and a header declaring the cipher_null-ecb null keyslot algorithm is accepted without error, so the Initializer assumes the device is protected when 'cryptsetup open' succeeds and writes secrets to a volume that is plaintext or keyed with an attacker-known volume key. Exploitation requires host-level provisioning privilege (CVSS 4.0 AV:A/AC:L/PR:L/UI:N, confidentiality-only; independent assessment CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the adversary is a malicious or compromised infrastructure operator rather than a conventional remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is closed by Contrast 1.12.1, which ships cryptsetup 2.8.1, and further hardened by 1.13.0.