CVE-2026-100837
Received Received - Intake

Suffix Matching Flaw in Contrast (Edgeless Systems) Imagepuller

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary, so a registry entry such as [registries."ghcr.io."] is also applied to any host whose name merely ends in that byte sequence, including attacker-registered domains such as evilghcr.io. When an image or layer is pulled from such a sibling domain, the imagepuller sends the configured Authorization header (basic auth, registry token, or identity token), trusts the configured custom CA bundle, follows the configured mirror, and honours insecure-skip-verify (disabling TLS verification) for that host. Image integrity is not affected, as image bytes remain pinned by digest in the policy and are validated after the pull. Configurations that use a leading dot (e.g., [registries.".example.registry"]) are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100837
EUVD
EUVD-2026-87832

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
edgeless_systems contrast 1.20.0
edgeless_systems contrast to 1.20.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1289 The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Contrast through 1.20.0 uses unanchored suffix matching when selecting registry configurations. This means a registry configured for a domain like ghcr.io would also apply to any hostname ending with ghcr.io, including malicious domains like evilghcr.io. When an image is pulled from such a domain, the system sends configured authentication headers, trusts custom CA bundles, follows mirrors, and may disable TLS verification.

Detection Guidance

Check if Contrast versions <= 1.20.0 are installed by running: contrast version. Inspect registry configurations for entries like [registries."ghcr.io."] which may apply to sibling domains. Monitor network traffic for unexpected authentication headers or TLS bypass attempts to domains ending with configured FQDNs.

Impact Analysis

This vulnerability can lead to credential leaks (basic auth, registry tokens, identity tokens) being sent to attacker-controlled domains. It may also allow TLS bypass via custom CA bundles or insecure-skip-verify settings. Image integrity remains unaffected as bytes are validated by digest after pulling.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of authentication credentials, custom CA certificates, or registry mirrors to untrusted domains. For GDPR, this may violate principles of data protection and confidentiality. For HIPAA, it could compromise secure handling of protected health information if registry credentials or TLS settings are exposed to malicious domains.

Mitigation Strategies

Update Contrast to a patched version replacing suffix matching with exact label equality. As a workaround, configure explicit subdomains to avoid unintended matches. Remove any registry entries with trailing dots and review custom CA bundles, mirrors, and TLS settings for affected domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart