Contrast performs unanchored suffix matching when selecting per‑registry configuration for image pulls. It strips a trailing dot and then tests if a hostname ends with a configured fully‑qualified domain name without enforcing DNS label boundaries. Because of this flaw, a registry entry such as registries."ghcr.io." will be applied to any host whose name ends in "ghcr.io", including attacker‑controlled domains like evilghcr.io. When an image is pulled from such a domain the imagepuller automatically sends the configured Authorization header, trusts a custom CA bundle, follows a mirror, and honors insecure‑skip‑verify, thereby leaking credentials to the malicious registry. Image bytes are still validated by digest, so integrity is not compromised, but the sent credentials can be used by an attacker to access upstream services or resources.

Affected installations are any deployment of Edgeless Systems Contrast version 1.20.0 or earlier that uses per‑registry configuration with suffix matching. The product is the Contrast image pulling component, and no other Edgeless product or version is currently listed as vulnerable.

The flaw has a CVSS base score of 6.3 and currently no EPSS value is available; it is not listed in CISA KEV. Attackers can register a domain that ends with the vulnerable suffix, and the mis‑applied registry entry will cause the imagepuller to send authorized credentials over possibly insecure connections. Exploitation requires network reach to the pulling environment and the ability to control a domain name matching the suffix but does not need elevated privileges. The risk is moderate and remediation is recommended.