CVE-2025-71425

Contrast before 1.8.1 Information Disclosure via Logging

Published Sep 27, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.

Analysis

Technical impact

Contrast before version 1.8.1 logs workload secrets to standard error when the log level is set to info or debug, causing those secrets to be captured in Kubernetes pod logs. The exposure allows any user with get or list permissions on pod logs to read secrets that should be restricted to the Contrast Coordinator, initializer, seedshare owner, or workload owner. This is a direct disclosure of confidential data and is classified as CWE-532.

Affected Systems

All installations of Edgeless Systems Contrast running a version earlier than 1.8.1 and using the default log level (info) are affected. Deployments that use workload secrets are at risk; systems that do not use workload secrets are unaffected.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity vulnerability, but the EPSS score is not available, so the likelihood of exploitation is unknown. The issue appears to be exploitable via normal Kubernetes log access, meaning any authenticated Kubernetes user with pod log permissions or any cloud provider with read access to the log storage can potentially read the leaked secrets. The vulnerability is not currently listed in CISA's KEV catalog but still poses a significant confidentiality risk if the logs are accessed by an unauthorized party.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

edgelesssys

contrast

unaffected

Version	Status	Constraints
`0`	affected	< 1.8.1
`1.8.1`	unaffected	—

No data.

Vendor Product Versions

Edgelesssys

Contrast

Version	Status	Scheme	Platform
`[0,1.8.1)`	affected	generic	—
`[1.8.1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Contrast version 1.8.1 or later, where the logging issue has been fixed.
If an upgrade is not immediately possible, set the CONTRAST_LOG_LEVEL environment variable to warning or higher to prevent secrets from being logged.
Restrict Kubernetes RBAC permissions for pod log access or remove unauthorized users from the cluster.
If information has already been exposed, rotate all affected workload secrets.

Generated by OpenCVE AI on September 27, 2026 at 03:29 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.190% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8
https://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging

History

Sep 30, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 27, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Edgelesssys Edgelesssys contrast
Vendors & Products		Edgelesssys Edgelesssys contrast

Sep 27, 2026 2:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.
Title		Contrast before 1.8.1 Information Disclosure via Logging
Weaknesses		CWE-532
References		https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8 https://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`