CVE-2026-116197

LOW 2.6

Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

CVSS Score

2.6

EPSS Score

0.0%

EPSS Percentile

0th

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

CWE	CWE-1289
Vendor	edgelesssys
Product	contrast
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for edgelesssys contrast

Be the first to know when new low vulnerabilities affecting edgelesssys contrast are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

edgelesssys / contrast

1.21.0 < 1.25.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/edgelesssys/contrast/security/advisories/GHSA-w4p9-c7h8-jvgr vulncheck.com: https://www.vulncheck.com/advisories/contrast-1.21.0-before-1.25.0-credential-leak-via-imagepuller-wildcard-registry-selection