CVE-2025-71423
Received Received - Intake

Contrast Kubernetes Runtime Workload Secret Exposure

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2025-71423
EUVD
EUVD-2025-211009

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
edgelesssys contrast From 1.9.0 (inc) to 1.12.2 (exc)
edgelesssys contrast to 1.12.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Edgelesssys Contrast versions before 1.12.2 have a vulnerability where the initializer logs the full NewMeshCert response, including workload secrets, to standard output at INFO level. This exposes secrets to any Kubernetes user with get or list permissions on pods/logs. Workload secrets are used for encrypted storage and Vault integration, so their compromise is critical.

Detection Guidance

Check Kubernetes pod logs for the Contrast initializer component for entries containing workload secrets or full NewMeshCert responses. Use commands like kubectl logs <pod-name> --tail=100 | grep -i "NewMeshCert" or kubectl logs <pod-name> --tail=100 | grep -i "workload secret" to search for exposed secrets.

Impact Analysis

An attacker with Kubernetes pod/log permissions could access workload secrets logged by the initializer. This could lead to unauthorized access to encrypted storage, Vault integration, or other sensitive data protected by these secrets. The exposure requires reinitialization of the Contrast cluster to restore security.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and confidentiality, such as GDPR (data breach notification) and HIPAA (unauthorized access to protected health information). The exposure of workload secrets could result in regulatory penalties due to compromised encryption keys and sensitive data access.

Mitigation Strategies

Upgrade Contrast to version 1.12.2 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to pod logs by removing get/list permissions for non-admin users. Rotate all exposed workload secrets and reinitialize the Contrast cluster as secrets may have been compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71423. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart