High severity · published Sep 27, 2026
CVE-2025-71423
Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
contrast · edgelesssys
1.9.0 before 1.12.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-71423
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-71423
vendor-advisory
https://github.com/edgelesssys/contrast/security/advisories/GHSA-vxg3-w9rv-rhr2
patch
https://github.com/edgelesssys/contrast/commit/5a5512c4af63c17bb66331e7bd2768a863b2f225
patch
https://github.com/edgelesssys/contrast/commit/cf58026b30c43fe7df91eac5322da02e1725d554
third-party-advisory
https://www.vulncheck.com/advisories/edgelesssys-contrast-before-1.12.2-workload-secrets-information-disclosure
More from contrast
9.6
CVE-2026-100833
Contrast before 1.23.1 Image Substitution via Policy Generation
8.4
CVE-2026-100839
Contrast before 1.18.0 AML Injection Remote Code Execution
8.1
CVE-2026-100838
Contrast before 1.19.1 CopyFile Policy Symlink Subversion
7.8
CVE-2026-109358
Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation
7.7
CVE-2026-109359
Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery