All vulnerabilities
CVE-2026-100838GHSA-rh99-wc69-c255GO-2026-5624

Contrast before 1.19.1 CopyFile Policy Symlink Subversion

edgelesssys contrastGoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.19.1Fixed versionCVE List
Published27 Sep 2026Updated 8 Oct 2026CVE List

What fixes it

  • 1.19.1contrastCVE List
  • 1.19.1github.com/edgelesssys/contrast, GoOSVgo get github.com/edgelesssys/contrast@v1.19.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could issue a series of CopyFile requests to overwrite security-critical files in the guest or trick the workload into disclosing sensitive data, effectively amounting to a full guest takeover. Users unable to upgrade can apply an equivalent rego policy fix passed to 'contrast generate --policy'.

Text from CVE List

Affected versions 3

  • contrastaffected: all versions before 1.19.1CVE List
  • contrastunaffected: 1.19.1CVE List
  • github.com/edgelesssys/contrast, Gofrom first release, fixed in 1.19.1OSV

References 2