Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-100835: Contrast before 1.16.0 lets attackers impersonate services
CVE-2026-100835 · published 14 days ago
Summary
Versions of Contrast earlier than 1.16.0 can be tricked into accepting identity proofs that come from a different machine. This means someone who can watch the network traffic and control a trusted device could pretend to be the Contrast Coordinator or a protected workload, potentially exposing data. Upgrade to version 1.16.0 or later to bind proofs to the actual hardware and stop the attack.
What to do
- Update edgelesssys contrast to version 1.16.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| edgelesssys | contrast | < 1.16.0 |
Original advisory text
Contrast before 1.16.0 Remote Attestation Relay Attack
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1008... Vendor Advisory
- https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h
- https://nvd.nist.gov/vuln/detail/CVE-2026-100835 Vendor Advisory
- https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-r...
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-295Improper Certificate Validation
Timeline
Published27 Sep 2026
Updated9 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-100835 · NVD
CVE-2026-100835 · MITRE
CVE-2026-100835 · OSV
GHSA-hjgc-jc5v-fw7h · GHSA
Track software like this
Free during beta