CVE-2025-71426

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recovering party. An attacker can therefore stand up a rogue Coordinator whose manifest passes validation but whose secret seed is attacker-controlled. If network traffic is redirected from the legitimate Coordinator to the attacker's Coordinator, a workload owner can be impersonated when they either set a new manifest without comparing the returned root CA certificate against the existing one (the default behavior of the contrast CLI) or verify the Coordinator without comparing the root CA certificate against a trusted reference. Under these conditions the attacker can issue certificates that chain back to the rogue Coordinator's root CA and recover arbitrary workload secrets of workloads deployed after the attack. Secrets of the legitimate Coordinator (seed, workload secrets, CA), workload integrity, and certificates chaining to the mesh CA are not affected.

• CWE-285

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-vqv5-385r-2hf8
• https://www.vulncheck.com/advisories/contrast-before-1.4.1-coordinator-impersonation-via-unauthenticated-recovery

Published

Sep 27, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-71420UVdesk core-framework before 1.1.7 contains an authorization…4.3
• CVE-2025-71421UVdesk core-framework before 1.1.7 contains an improper priv…7.2
• CVE-2025-71422Contrast is a Kubernetes runtime for confidential containers…5.7
• CVE-2025-71423Edgelesssys Contrast is a confidential-computing runtime for…7.3
• CVE-2025-71424Contrast, Edgeless Systems' runtime for confidential contain…3.5
• CVE-2025-71425Contrast (Edgeless Systems) before 1.8.1 logs the workload s…7.3
• CVE-2025-71427Office-PowerPoint-MCP-Server through 2.0.7 contains a path t…6.8
• CVE-2025-71428Jivejdon through 5.0 contains a sql injection vulnerability …4.9
• CVE-2025-71429GPT-SoVITS through 20250606v2pro contains an OS command inje…9.8
• CVE-2025-7143A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2025-71430Frappe before 14.99.10 and 15.x before 15.91.1 contains a st…5.4
• CVE-2025-71431Frappe before 14.99.2 and 15.x before 15.86.0 contains an LD…5.3