CVE-2025-71425
Received Received - Intake

Contrast Initializer Logs Workload Secrets to Kubernetes Logs

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2025-71425
EUVD
EUVD-2025-211007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
edgeless_systems contrast to 1.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Contrast software versions before 1.8.1. When the log level is set to INFO or DEBUG (the default is INFO), workload secrets are logged to stderr and Kubernetes logs. This exposes secrets to unauthorized users with access to Kubernetes logs, such as those with pod/log permissions or cloud providers.

Detection Guidance

Check Kubernetes logs for Contrast initializer pods for any exposure of workload secrets. Use commands like 'kubectl logs <pod-name>' to inspect logs. Look for entries containing 'secret' or sensitive workload data in stderr or log files.

Impact Analysis

Unauthorized parties may access workload secrets through Kubernetes logs. This could lead to data breaches, unauthorized access to sensitive workloads, or compromise of systems relying on these secrets. Only deployments using workload secrets are affected.

Compliance Impact

This vulnerability may violate compliance requirements for data protection and confidentiality, such as GDPR or HIPAA, by exposing sensitive workload secrets. Unauthorized access to secrets could result in regulatory penalties or loss of trust.

Mitigation Strategies

Set CONTRAST_LOG_LEVEL to WARN in the Contrast initializer configuration. Regenerate configurations and redeploy the affected workloads. Ensure no workload secrets are exposed in logs by verifying log outputs after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart