CVE-2026-116197

Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

Published Oct 25, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Description

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

Analysis

Technical impact

The vulnerability is a non‑deterministic registry selection flaw in the imagepuller component of Edgeless Systems Contrast. When configuration specifies both a concrete registry domain and a parent wildcard entry, the implementation may prioritize the wildcard, causing credentials, CA bundles or mirror settings intended for the wildcard to be applied to the concrete registry. This can leak registry credentials or pull metadata to services that pull images from the concrete domain. The flaw is documented as CWE‑1289.

Affected Systems

All Contrast releases from 1.21.0 up to, but not including, 1.25.0 are affected. This includes any framework installation that relies on the imagepuller component within that version range. Packages or deployments that use earlier releases are not impacted.

Risk and Exploitability

The CVSS score of 2.1 indicates low overall severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS data are not available, so the likelihood of exploitation is unclear. Based on the description, the attack requires the ability to influence the imagepuller configuration, such as through privileged or remote configuration management. Thus the exploit would likely be a local or privileged attack rather than a remotely exploitable vulnerability. The impact mainly involves inadvertent leakage of registry credentials or related metadata.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

edgelesssys

contrast

unaffected

Version	Status	Constraints
`1.21.0`	affected	< 1.25.0
`1.25.0`	unaffected	—

No data.

Vendor Product Versions

Edgelesssys

Contrast

Version	Status	Scheme	Platform
`[1.21.0,1.25.0)`	affected	semver	—
`1.25.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to Contrast version 1.25.0 or later, which removes the registry selection flaw.
If an immediate upgrade is not possible, eliminate or restrict the use of wildcard registry entries in the imagepuller configuration, ensuring that concrete domain credentials are explicitly defined and take precedence.
Verify that any credential or CA bundle associated with a wildcard entry is removed or quarantined, and validate that regular image pulls do not use those credentials.

Generated by OpenCVE AI on October 25, 2026 at 16:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.159% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/edgelesssys/contrast/security/advisories/GHSA-w4p9-c7h8-jvgr
https://www.vulncheck.com/advisories/contrast-1.21.0-before-1.25.0-credential-leak-via-imagepuller-wildcard-registry-selection

History

Oct 29, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Edgelesssys Edgelesssys contrast
Vendors & Products		Edgelesssys Edgelesssys contrast

Oct 25, 2026 1:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
Title		Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection
Weaknesses		CWE-1289
References		https://github.com/edgelesssys/contrast/security/advisories/GHSA-w4p9-c7h8-jvgr https://www.vulncheck.com/advisories/contrast-1.21.0-before-1.25.0-credential-leak-via-imagepuller-wildcard-registry-selection
Metrics		cvssV3_1 `{'score': 2.6, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`