Edgelesssys vulnerabilities
We track 10 vulnerabilities in Edgelesssys products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest Edgelesssys vulnerabilities
- 7.7 High severity
contrast: Insufficient Verification of Data Authenticity
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history
- 7.8 High severity
contrast: Incorrect Permission Assignment for Critical Resource
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwr
- 8.4 High severity
contrast: Improper Control of Generation of Code
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). ACPI tables containing AML bytecode are passed from the untrusted host (QEMU) to t
- 8.1 High severity
contrast: Improper Link Resolution Before File Access
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious
- 7.4 High severity
contrast: Improper Certificate Validation
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it,
- 9.6 Critical severity
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that…
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage ent
- 7.1 High severity
contrast: Improper Authorization
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recovering party. An attacker can therefore stand up a rogue Coordinator whose manifest passes validation b
- 7.3 High severity
contrast: Insertion of Sensitive Information into Log File
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not custo
- 7.3 High severity
contrast: Insertion of Sensitive Information into Log File
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets
- 8.3 High severity
constellation: Improper Verification of Cryptographic Signature
Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is suc