{"schema":"threatline.record/2","record":{"id":"CVE-2026-100833","aliases":["GHSA-m2qg-wrxv-h898"],"summary":"Contrast before 1.23.1 Image Substitution via Policy Generation","details":"Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.","categories":["Unclassified"],"product":"contrast","vendor":"edgelesssys","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100833","source_modified_at":"2026-10-09T13:22:54.929Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"contrast","vendor":"edgelesssys","versions":[{"lessThan":"1.23.1","status":"affected","version":"1.14.0","versionType":"semver"},{"status":"unaffected","version":"1.23.1","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898","source_modified_at":"2026-09-29T04:40:45Z","fetched_at":"2026-10-23T20:39:26.410340Z","package":{"name":"contrast","ecosystem":null},"range":"v1.14.0..v1.23.0"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100833","source_modified_at":"2026-10-09T13:22:54.929Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"contrast","ecosystem":null},"version":"1.23.1","basis":"first unaffected version stated in the CVE record"}],"cvss":8.6,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00234,"percentile":0.13476,"score_date":"2026-10-23"},"published_at":"2026-09-27T01:28:32.099Z","modified_at":"2026-10-09T13:22:54.929Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100833","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-09T13:22:54.929Z"},{"source":"GitHub Advisory Database","url":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898","fetched_at":"2026-10-23T20:39:26.410340Z","source_modified_at":"2026-09-29T04:40:45Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100833","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/contrast-before-1.23.1-image-substitution-via-policy-generation","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-28T13:53:22.400645Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T13:22:54.929Z","content_hash":"76b169b99b563857d5c84109a7c82f5f76a36a126b0bd5eda5dcac2799fe205a"}}