Edgelesssys Contrast is a confidential‑computing runtime for Kubernetes. In versions from 1.9.0 up to before 1.12.2 the system initializer logs the full NewMeshCert response, which includes the workload secret, to standard output at the INFO level. The logged secret can then be read by any Kubernetes user who has the ability to get or list pod logs. Because the secret is used for encrypted storage and Vault integration, those downstream systems are also considered compromised.

The vulnerability affects Edgelesssys Contrast installations running any version between 1.9.0 and before 1.12.2. These versions perform an insecure log of the NewMeshCert response containing the secret. Users of older or later releases are not impacted.

The vulnerability carries a CVSS score of 8.5, indicating high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an attacker who gains or already possesses permission to read pod logs; such an attacker can then extract the workload secret from the logs. Once the secret is known, the attacker can decrypt data stored by the node and access Vault integration, potentially leading to broader compromise of the cluster. No additional prerequisites are mentioned beyond log‑reading privileges.