edgelesssys

9 results · Clear filters · Feed

• High 7.8
  CVE-2026-109358

  Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

  Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overw…

  edgelesssys contrast
  Oct 12, 2026
• High 7.7
  CVE-2026-109359

  Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

  Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history…

  edgelesssys contrast
  Oct 12, 2026
• High 8.4
  CVE-2026-100839

  Contrast before 1.18.0 AML Injection Remote Code Execution

  Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). ACPI tables containing AML bytecode are passed from the untrusted host (QEMU) to …

  edgelesssys contrast github.com/edgelesssys/contrast Go
  Sep 27, 2026
• High 8.1
  CVE-2026-100838

  Contrast before 1.19.1 CopyFile Policy Symlink Subversion

  Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious…

  edgelesssys contrast github.com/edgelesssys/contrast Go
  Sep 27, 2026
• High 7.4
  CVE-2026-100835 Public exploit

  Contrast before 1.16.0 Remote Attestation Relay Attack

  Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it…

  edgelesssys contrast
  Sep 27, 2026
• High 7.3
  CVE-2025-71425

  Contrast before 1.8.1 Information Disclosure via Logging

  Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not cust…

  edgelesssys contrast github.com/edgelesssys/contrast Go
  Sep 27, 2026
• High 7.1
  CVE-2025-71426

  Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery

  Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recovering party. An attacker can therefore stand up a rogue Coordinator whose manifest passes validation …

  edgelesssys contrast github.com/edgelesssys/contrast Go
  Sep 27, 2026
• High 7.3
  CVE-2025-71423

  Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure

  Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets…

  edgelesssys contrast github.com/edgelesssys/contrast Go
  Sep 27, 2026
• High 8.3
  CVE-2025-58356

  Constellation allows insecure use of LUKS2 persistent storage partitions

  Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is su…

  edgelesssys constellation github.com/edgelesssys/constellation github.com/edgelesssys/constellation/v2 Go
  Oct 27, 2025