CVE-2026-100838
Received Received - Intake

Arbitrary File Write in Contrast Kubernetes Runtime

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could issue a series of CopyFile requests to overwrite security-critical files in the guest or trick the workload into disclosing sensitive data, effectively amounting to a full guest takeover. Users unable to upgrade can apply an equivalent rego policy fix passed to 'contrast generate --policy'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100838
EUVD
EUVD-2026-87850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
contrast contrast to 1.19.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100838 is a high-severity vulnerability in Contrast, a confidential-computing runtime for Kubernetes. It affects versions before 1.19.1 where the Kata agent policies generated by the Contrast CLI had a flaw in CopyFile verification. This flaw allowed arbitrary writes to the guest root filesystem. A malicious host process with VSOCK access could exploit this to overwrite critical files or extract sensitive data, leading to full guest system takeover.

Detection Guidance

Detecting this vulnerability requires checking the version of Contrast installed on your system. Run 'contrast version' to verify if your version is below 1.19.1. Additionally, inspect Kata agent policies for improper CopyFile verification by examining generated policies or logs for suspicious VSOCK connections to the Kata agent.

Impact Analysis

If exploited, this vulnerability could allow an attacker to overwrite security-critical files in the guest system or trick workloads into disclosing sensitive data. This could result in unauthorized access, data breaches, or complete compromise of the guest system. Attackers need VSOCK access to the Kata agent, but the impact is severe if they gain it.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. A successful exploit may result in data breaches, non-compliance penalties, and loss of trust in systems handling sensitive data.

Mitigation Strategies

Upgrade Contrast to version 1.19.1 or later immediately. If upgrading is not possible, apply the Rego policy fix using 'contrast generate --policy' to enforce proper CopyFile verification. Ensure no untrusted host processes have VSOCK access to the Kata agent.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart