CVE-2025-71425High· 7.3▾ TwilightContrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installa…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/edgelesssys/contrast < 1.8.1Patched in:
github.com/edgelesssys/contrast 1.8.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-71423High· 7.3Edgelesssys Contrast is a confidential-computing runtime for Kubernetes
CVE-2026-100839High· 8.4Contrast is a confidential-computing runtime for Kubernetes
CVE-2026-100837Low· 3.7Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller
CVE-2026-100838High· 8.1Contrast is a confidential-computing runtime for Kubernetes
CVE-2026-100836Medium· 4.3Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing
CVE-2025-71426High· 7.1Contrast is a confidential-computing runtime for Kubernetes