Live › vulnerability › CVE-2026-116197
Go to dashboardEdgeless Systems Contrast from 1.21.0 before 1.25.0 has a non-deterministic registry match in imagepuller that sometimes prefers a wildcard entry over a concrete domain. Registry credentials, CA bundles or mirror settings meant for the wildcard may then be used against the concrete registry, leaking credentials or pull metadata.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running Edgeless Systems Contrast from 1.21.0 up to but not including 1.25.0 whose imagepuller pull configuration lists both a concrete registry domain and a wildcard parent domain. Deployments with a single registry or no wildcard entries are not described as exposed.
No product ranges from the sources yet.
1.25.01.25.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
This page as .md · .json · in your agent: get_signal("CVE-2026-116197")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.