CVE-2026-116197
Last modified
CVE-2026-116197 is a low-severity vulnerability rated 2.6/10 on the CVSS scale. Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata..
Description
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-116197?
How severe is CVE-2026-116197?
How do I fix CVE-2026-116197?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-116191Rclone before 1.75.2 contains a path traversal vulnerability…7.5
- CVE-2026-116192rclone from 1.37 before 1.74.2 contains a server-side reques…5.9
- CVE-2026-116193Rclone from 1.64.0 before 1.75.2 contains an authentication …5.3
- CVE-2026-116194Rclone from 1.52.0 before 1.75.2 contains a cross-site reque…6.8
- CVE-2026-116195Rclone before 1.75.2 contains a path traversal vulnerability…6.1
- CVE-2026-116196Rclone before v1.75.2 contains a credential exposure vulnera…5.3
- CVE-2026-116198Snipe-IT before 8.7.0 contains a missing encryption vulnerab…4.3
- CVE-2026-116199Snipe-IT before 8.6.3 contains an authentication bypass in G…8.1
- CVE-2026-1162A flaw has been found in UTT HiPER 810 1.7.4-141218. The imp…9.8
- CVE-2026-11620A security flaw has been discovered in TOTOLINK EX200 4.0.3c…5.5
- CVE-2026-116200Snipe-IT before 8.6.3 ignores the ldap_start_tls() return va…5.9
- CVE-2026-116201Snipe-IT before 8.5.0 contains a SAML assertion replay vulne…8.8
Are you affected by CVE-2026-116197?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST