CVE-2026-100833

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.

• CWE-20

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898
• https://www.vulncheck.com/advisories/contrast-before-1.23.1-image-substitution-via-policy-generation

Published

Sep 27, 2026

Last Modified

Sep 27, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10079A flaw was found in Red Hat Advanced Cluster Security for Ku…8.5
• CVE-2026-1008A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2026-10080Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 1…6.5
• CVE-2026-10081The Unlimited Elements For Elementor WordPress plugin before…8.8
• CVE-2026-10082The Advanced Ads WordPress plugin before 2.0.23 does not sa…6.1
• CVE-2026-10083The APCu Manager WordPress plugin before 4.5.0 does not esca…7.5
• CVE-2026-100834http4k's Digest authentication module (org.http4k:http4k-sec…5.9
• CVE-2026-100835Contrast before 1.16.0 is susceptible to remote attestation …7.4
• CVE-2026-100836Contrast through 1.20.0 contains a panic vulnerability in th…4.3
• CVE-2026-100837Contrast (Edgeless Systems) through 1.20.0 performs unanchor…3.7
• CVE-2026-100838Contrast is a confidential-computing runtime for Kubernetes.…8.1
• CVE-2026-100839Contrast is a confidential-computing runtime for Kubernetes.…8.4