CVE-2026-100833

Katalog CVE

CVSS 9.6 · Critical EPSS 0,23%

Kerentanan Improper Input Validation. Skor CVSS 3.1 9.6 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.

Rincian

Terbit di NVD

27 September 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Deferred

CVSS 3.1

9.6 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898
• https://www.vulncheck.com/advisories/contrast-before-1.23.1-image-substitution-via-policy-generation