CVE-2026-109359
Received Received - Intake

Coordinator Peer Recovery Flaw in Contrast 1.8.0 to 1.24.0

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109359
EUVD
EUVD-2026-97661

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
edgelesssys contrast 1.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Contrast 1.8.0 before 1.24.1 involves improper verification during Coordinator peer recovery. The system fails to confirm if the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head, allowing withdrawn workloads to obtain trusted mesh certificates. Additionally, attackers with the secret seed can disclose the Mesh CA key.

Detection Guidance

To detect this vulnerability, check if your Contrast version is 1.24.0 or earlier. Use commands like 'contrast version' or inspect deployment manifests for version details. Contrast verify can detect mismatches between active and expected manifests.

Impact Analysis

If exploited, this vulnerability could allow attackers to impersonate legitimate workloads by obtaining trusted mesh certificates, potentially leading to unauthorized access or data breaches. In cases where the Mesh CA key is disclosed, attackers could decrypt sensitive communications or issue fraudulent certificates.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Failure to protect mesh certificates and CA keys may result in non-compliance with data protection regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade Contrast to version 1.24.1 or later to address the improper verification vulnerability in Coordinator peer recovery.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109359. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart