Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.5

Edgelesssys Contrast may expose workload secrets

CVE-2025-71423 · published 1 month ago
Summary

In versions before 1.12.2, the Contrast runtime writes the full secret information to its standard output. Anyone who can view pod logs can see these secrets, which include encryption keys and vault credentials, putting your data at risk. Update to version 1.12.2 or later and restrict log‑view permissions to protect the secrets.

What to do
  • Update edgelesssys github.com/edgelesssys/contrast to version 1.12.2.
  • Update edgelesssys contrast to version 1.12.2 or later.
Affected software
Ecosystem VendorProductAffected versions
– edgelesssys contrast < 1.12.2
Go edgelesssys github.com/edgelesssys/contrast >= 1.9.0, < 1.12.2
Fix: upgrade to 1.12.2
Original advisory text
Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published27 Sep 2026
Updated29 Oct 2026
First seen27 Sep 2026
Sources
CVE-2025-71423 · NVD
CVE-2025-71423 · MITRE
GHSA-vxg3-w9rv-rhr2 · OSV
Track software like this
Free during beta