CVE-2026-116197
Deferred Deferred - Pending Action

Contrast Registry Credential Leak via Wildcard Override

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116197
EUVD
EUVD-2026-109455

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
edgelesssys contrast 1.21.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1289 The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Edgeless Systems Contrast versions 1.21.0 to 1.25.0. It involves a flaw in the imagepuller component where wildcard registry configurations can override specific domain matches. This may cause the system to apply incorrect credentials or settings, potentially leaking sensitive information like registry credentials or pull metadata.

Detection Guidance

Check Contrast version with: kubectl get pods -n contrast-system -l app.kubernetes.io/name=contrast -o jsonpath='{.items[0].spec.containers[0].image}' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+'. If version is between 1.21.0 and 1.24.9, the system is vulnerable. Review registry pull configurations for wildcard entries like .example.com alongside concrete domains such as registry.example.com.

Impact Analysis

If exploited, this flaw could lead to unauthorized access to registry credentials or metadata, compromising the security of container images pulled from registries. Attackers might intercept or manipulate image pulls, risking data breaches or supply chain attacks.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data such as registry credentials or image pull metadata. GDPR and HIPAA mandate strict data protection and access controls, so unauthorized exposure may result in non-compliance, legal penalties, or reputational damage.

Mitigation Strategies

Upgrade Edgeless Systems Contrast to version 1.25.0 or later to address the registry selection flaw in imagepuller.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart