CVE-2026-100833 PUBLISHED

Contrast before 1.23.1 Image Substitution via Policy Generation

Assigner: VulnCheck
Reserved: 26.09.2026 Published: 27.09.2026 Updated: 27.09.2026

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allow_storage rule that accepts storage entries using the image_guest_pull driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.6

Product Status

Vendor edgelesssys
Product contrast
Versions Default: unaffected
  • affected from 1.14.0 to 1.23.1 (excl.)
  • Version 1.23.1 is unaffected

Credits

  • sespiros finder
  • burgerdev finder

References

Problem Types

  • Improper Input Validation CWE