Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116197Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

Low 2.6

In plain English

A low-severity security flaw in contrast from edgelesssys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

Affected products (as reported)

Vendor	Product	Versions
edgelesssys	contrast	1.21.0 – before 1.25.0

Weakness: CWE-1289 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-w4p9-c7h8-jvgr) vendor-advisory
VulnCheck Advisory: Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection third-party-advisory