Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2025-71423Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure
High 7.3
In plain English
A high-severity sensitive data in logs in contrast from edgelesssys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/edgelesssys/contrast | 1.12.2 | GHSA-vxg3-w9rv-rhr2 |
| Go | github.com/edgelesssys/contrast | 1.12.2 | GO-2025-3920 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| edgelesssys | contrast | 1.9.0 – before 1.12.2 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-vxg3-w9rv-rhr2) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure third-party-advisory