Contrast workload secrets leak to logs on INFO level
Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-h5f8-crrq-4pw8
Published### Impact When the Contrast initializer is configured with a `CONTRAST_LOG_LEVEL` of `info` or `debug`, the workload secret is logged to `stderr` and written to Kubernetes logs. Since `info` is the default setting, this affects all Contrast installations that don't customize their initializers' log level. The following audiences are **intended** to have access to workload secrets (see https://docs.edgeless.systems/contrast/1.7/architecture/secrets#workload-secrets): * Contrast Coordinator (can derive all workload secrets) * Contrast Initializer (obtains only the secret configured in the manifest) * Seedshare owner (can derive all workload secrets) * Workload owner (can update manifests to obtain secrets) This vulnerability allows the following parties **unintended access** to workload secrets issued by a Coordinator: * Kubernetes users with `get` or `list` permission on `pods/logs`. * Others with read access to the Kubernetes log storage (most notably, the cloud provider). This vulnerability **does not affect** scenarios where workload secrets are not used by the application (directly or with [secure persistence](https://docs.edgeless.systems/contrast/1.7/architecture/secrets#secure-persistence)). Applications designed for workload owner exclusion can't use workload secrets and are thus unaffected. ### Patches N/A ### Workarounds This vulnerability can be mitigated by adding an environment variable `CONTRAST_LOG_LEVEL=warn` to the initializer after running `contrast generate`, and then running `contrast generate` again. ### References N/A
- Source published
- 28 May 2025 14:40:25 UTC
- Source modified
- 27 Sep 2026 11:55:47 UTC
- Observed here
- 24 Oct 2026 13:19:41 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS_V3 · CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Publisher rating · HIGH