{"id":"EUVD-2025-211007","enisaUuid":"74410c85-85c6-33e5-9e05-6ed517a5822c","description":"Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.","datePublished":"Sep 27, 2026, 1:28:27 AM","dateUpdated":"Oct 8, 2026, 3:21:38 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8\nhttps://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging\n","aliases":"CVE-2025-71425\nGHSA-7f88-pr8w-xgw6\n","assigner":"VulnCheck","epss":0.19,"enisaIdProduct":[{"id":"c2ee311e-b242-3d8b-be05-c7f639673f0b","product":{"name":"contrast","vendor":{"name":"edgelesssys"}},"product_version":"0 \u003c1.8.1"}],"enisaIdVendor":[{"id":"fae9e6b0-e332-306b-bfa3-04b0c98a8c51","vendor":{"name":"edgelesssys"}}],"enisaIdVulnerability":[{"id":"47bb0e21-8e4f-354c-81cb-ce449efc3eb7","vulnerability":{"id":"CVE-2025-71425","description":"Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.","datePublished":"Sep 27, 2026, 1:28:27 AM","dateUpdated":"Oct 8, 2026, 3:21:38 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8\nhttps://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging\n","enisa_id":"EUVD-2025-211007\n","assigner":"VulnCheck","epss":0.19,"dataProcessed":"Nov 8, 2026, 7:19:48 AM","vulnerabilityProduct":[{"id":"edb2c2f6-c0d4-36f9-8975-7cb723f278d5","product":{"name":"contrast","vendor":{"name":"edgelesssys"}},"product_version":"0 \u003c1.8.1"}],"vulnerabilityVendor":[{"id":"1da0e279-718d-3a09-93fa-abe17d645395","vendor":{"name":"edgelesssys"}}]}},{"id":"b8632bc9-f2c5-316e-8ff3-d546db1fe9ee","vulnerability":{"id":"GHSA-7f88-pr8w-xgw6","description":"Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.","datePublished":"Sep 27, 2026, 3:31:03 AM","dateUpdated":"Sep 27, 2026, 3:31:03 AM","baseScore":0.0,"references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71425\nhttps://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging\n","enisa_id":"EUVD-2025-211007\n","aliases":"CVE-2025-71425\nGHSA-7f88-pr8w-xgw6\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}