High severity · published Oct 12, 2026
CVE-2026-109359
Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery
7.7
CVSS
0.1%
EPSS
No
On KEV
Description
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
contrast · edgelesssys
1.8.0 before 1.24.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109359
vendor-advisory
https://github.com/edgelesssys/contrast/security/advisories/GHSA-rxcv-p3px-m3c3
third-party-advisory
https://www.vulncheck.com/advisories/contrast-1.8.0-before-1.24.1-mesh-ca-key-cross-manifest-exposure-via-peer-recovery
More from contrast
9.6
CVE-2026-100833
Contrast before 1.23.1 Image Substitution via Policy Generation
8.4
CVE-2026-100839
Contrast before 1.18.0 AML Injection Remote Code Execution
8.1
CVE-2026-100838
Contrast before 1.19.1 CopyFile Policy Symlink Subversion
7.8
CVE-2026-109358
Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation
7.4
CVE-2026-100835
Contrast before 1.16.0 Remote Attestation Relay Attack