CVE-2026-109359
Last modified
CVE-2026-109359 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| edgelesssys | contrast | >= 1.8.0, < 1.24.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-109359?
How severe is CVE-2026-109359?
How do I fix CVE-2026-109359?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-109353LibreNMS before 26.9.0 contains an SQL injection vulnerabili…7.1
- CVE-2026-109354LibreNMS before 26.9.0 contains a path traversal vulnerabili…4.3
- CVE-2026-109355LibreNMS before 26.9.0 contains a stored cross-site scriptin…6.1
- CVE-2026-109356LibreNMS before 26.9.0 contains a missing authorization vuln…4.3
- CVE-2026-109357LibreNMS before 26.9.0 contains an LDAP filter injection in …8.1
- CVE-2026-109358Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an in…7.8
- CVE-2026-10936Type Confusion in V8 in Google Chrome prior to 149.0.7827.53…8.8
- CVE-2026-109360MONAI 0.4.0 before 1.6.1 contains a remote code execution vu…7.5
- CVE-2026-109361MONAI 1.2.0 before 1.6.1 contains an insecure deserializatio…7.3
- CVE-2026-109362Heym v0.0.5 before v0.0.113 contains a broken access control…5.4
- CVE-2026-109363ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 tr…7.5
- CVE-2026-109364Zebra 2.3.0 before 6.4.0 contains a protection mechanism fai…5.3
Are you affected by CVE-2026-109359?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST