Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-100833: Contrast lets malicious container image be substituted
CVE-2026-100833 · published 22 days ago
Summary
Versions of Contrast before 1.23.1 can create security rules that don’t check the exact identity of container images. If someone with access to the Kata agent interface (such as a cluster administrator) swaps a trusted image for a malicious one, the system may still accept it, breaking the promised confidentiality of the container. Upgrade Contrast to version 1.23.1 or later, or adjust the policy to verify image digests before allowing pulls.
What to do
- Update edgelesssys contrast to version 1.23.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| edgelesssys | contrast | < 1.23.1 |
Original advisory text
Contrast before 1.23.1 Image Substitution via Policy Generation
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1008... Vendor Advisory
- https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100833 Vendor Advisory
- https://www.vulncheck.com/advisories/contrast-before-1.23.1-image-substitution-v... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-20Improper Input Validation
Timeline
Published27 Sep 2026
Updated16 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-100833 · NVD
CVE-2026-100833 · MITRE
CVE-2026-100833 · OSV
GHSA-m2qg-wrxv-h898 · GHSA
Track software like this
Free during beta