Contrast offers a service mesh using certificates issued by a Mesh CA. In versions 1.8.0 through 1.24.0 the Coordinator’s peer recovery logic does not verify that a recovered peer’s manifest corresponds to the current generation. This represents a CWE‑345 type flaw. An attacker with write access to the manifest history can replay a superseded history head. This replay can make a withdrawn workload receive a trusted mesh certificate or, if the attacker also has the secret seed, reveal the Mesh CA private key, leaking full certificate authority credentials. The resulting confidentiality breach allows an attacker to impersonate services, decrypt traffic, and potentially compromise the entire mesh.

edgelesssys Contrast versions 1.8.0 to 1.24.0 are affected. Only these releases contain the improper verification flaw in the peer recovery component.

The vulnerability scores a CVSS of 8.7, indicating high severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, which suggests it may not have widespread exploitation yet but remains a serious risk. Exploitation requires write access to the manifest history – a privilege typically granted to cluster administrators or services with internal trust. The attack vector is therefore an insider or a compromised internal component. Once the Mesh CA key is disclosed, the attacker can forge certificates and subvert the entire mesh, effectively gaining complete control over service communication.