{"schema":"threatline.record/2","record":{"id":"CVE-2025-71423","aliases":["GHSA-vxg3-w9rv-rhr2","GO-2025-3920"],"summary":"Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure","details":"Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.","categories":["Libraries & packages"],"product":"contrast","vendor":"edgelesssys","ecosystem":"Go","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-71423","source_modified_at":"2026-10-08T15:21:37.337Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"contrast","vendor":"edgelesssys","versions":[{"lessThan":"1.12.2","status":"affected","version":"1.9.0","versionType":"semver"},{"status":"unaffected","version":"1.12.2","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vxg3-w9rv-rhr2","source_modified_at":"2026-09-27T11:55:47.535209031Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"github.com/edgelesssys/contrast","ecosystem":"Go","purl":"pkg:golang/github.com/edgelesssys/contrast"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.9.0"},{"fixed":"1.12.2"}]}],"versions":[]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-71423","source_modified_at":"2026-10-08T15:21:37.337Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"contrast","ecosystem":null},"version":"1.12.2","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vxg3-w9rv-rhr2","source_modified_at":"2026-09-27T11:55:47.535209031Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"github.com/edgelesssys/contrast","ecosystem":"Go","purl":"pkg:golang/github.com/edgelesssys/contrast"},"version":"1.12.2"}],"cvss":8.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00206,"percentile":0.10067,"score_date":"2026-10-23"},"published_at":"2026-09-27T01:28:25.878Z","modified_at":"2026-10-08T15:21:37.337Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-71423","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T15:21:37.337Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-vxg3-w9rv-rhr2","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-09-27T11:55:47.535209031Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71423","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-vxg3-w9rv-rhr2","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/edgelesssys/contrast/commit/5a5512c4af63c17bb66331e7bd2768a863b2f225","tags":["patch"]},{"source":"CVE List","url":"https://github.com/edgelesssys/contrast/commit/cf58026b30c43fe7df91eac5322da02e1725d554","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/edgelesssys-contrast-before-1.12.2-workload-secrets-information-disclosure","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-28T17:38:36.952855Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-08T15:21:37.337Z","content_hash":"0d73cc964e22dd1d5c86666ae4a3d28733214df9b749a4e3c6c5ef1fb249099a"}}