{"id":"EUVD-2025-211009","enisaUuid":"b740fc31-a17d-3918-97b5-d5431c96c225","description":"Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.","datePublished":"Sep 27, 2026, 1:28:25 AM","dateUpdated":"Oct 8, 2026, 3:21:37 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-vxg3-w9rv-rhr2\nhttps://github.com/edgelesssys/contrast/commit/5a5512c4af63c17bb66331e7bd2768a863b2f225\nhttps://github.com/edgelesssys/contrast/commit/cf58026b30c43fe7df91eac5322da02e1725d554\nhttps://www.vulncheck.com/advisories/edgelesssys-contrast-before-1.12.2-workload-secrets-information-disclosure\n","aliases":"CVE-2025-71423\nGHSA-8rwq-r56x-hx8f\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"ee4c4aa3-74b7-32ad-9a5a-ec129aa3b2e1","product":{"name":"contrast","vendor":{"name":"edgelesssys"}},"product_version":"1.9.0 \u003c1.12.2"}],"enisaIdVendor":[{"id":"b7fd1289-f6e7-32d3-a44a-7b65dd7fd3bd","vendor":{"name":"edgelesssys"}}],"enisaIdVulnerability":[{"id":"929b86e7-5b05-3742-861a-b3a22abbd475","vulnerability":{"id":"GHSA-8rwq-r56x-hx8f","description":"Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.","datePublished":"Sep 27, 2026, 3:31:03 AM","dateUpdated":"Sep 27, 2026, 3:31:03 AM","baseScore":0.0,"references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-vxg3-w9rv-rhr2\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71423\nhttps://github.com/edgelesssys/contrast/commit/5a5512c4af63c17bb66331e7bd2768a863b2f225\nhttps://github.com/edgelesssys/contrast/commit/cf58026b30c43fe7df91eac5322da02e1725d554\nhttps://www.vulncheck.com/advisories/edgelesssys-contrast-before-1.12.2-workload-secrets-information-disclosure\n","enisa_id":"EUVD-2025-211009\n","aliases":"CVE-2025-71423\nGHSA-8rwq-r56x-hx8f\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f96e4579-dc25-34f2-988f-f658513d7272","vulnerability":{"id":"CVE-2025-71423","description":"Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.","datePublished":"Sep 27, 2026, 1:28:25 AM","dateUpdated":"Oct 8, 2026, 3:21:37 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-vxg3-w9rv-rhr2\nhttps://github.com/edgelesssys/contrast/commit/5a5512c4af63c17bb66331e7bd2768a863b2f225\nhttps://github.com/edgelesssys/contrast/commit/cf58026b30c43fe7df91eac5322da02e1725d554\nhttps://www.vulncheck.com/advisories/edgelesssys-contrast-before-1.12.2-workload-secrets-information-disclosure\n","enisa_id":"EUVD-2025-211009\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 4, 2026, 7:19:11 AM","vulnerabilityProduct":[{"id":"09fbf2b2-0c7b-3255-a8ff-f815d30e2f16","product":{"name":"contrast","vendor":{"name":"edgelesssys"}},"product_version":"1.9.0 \u003c1.12.2"}],"vulnerabilityVendor":[{"id":"0cfc1dc1-ad27-3755-947d-4d36f6398a1d","vendor":{"name":"edgelesssys"}}]}}],"enisaIdAdvisory":[]}