{"id":"CVE-2026-116197","kind":"vulnerability","aliases":["CVE-2026-116197"],"related":[],"title":"Contrast: registry selection can send wildcard credentials to concrete registries","description":"Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.","summary":"Edgeless Systems Contrast from 1.21.0 before 1.25.0 has a non-deterministic registry match in imagepuller that sometimes prefers a wildcard entry over a concrete domain. Registry credentials, CA bundles or mirror settings meant for the wildcard may then be used against the concrete registry, leaking credentials or pull metadata.","severity":"low","cvss":2.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["confidential-containers","container-registries","contrast","infrastructure","kubernetes"],"not_affected_if":["no-wildcard-registry-entries","version-1.25.0-or-later"],"how_to_check":"- Check the installed Contrast version and whether it is below `1.25.0`\n- Review the imagepuller pull configuration for a concrete registry domain listed alongside a parent wildcard domain entry\n- unknown whether the sources name a specific config file path","fix":"- Upgrade Contrast to `1.25.0` or later\n- Rotate any registry credentials that were configured under a wildcard entry if a concrete registry sharing that parent domain was in use","status":"open","published_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:44:17+00:00","updated_at":"2026-10-25T14:44:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T14:44:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Contrast to `1.25.0` or later\n- Rotate any registry credentials that were configured under a wildcard entry if a concrete registry sharing that parent domain was in use","reach":"unknown","title":"Contrast: registry selection can send wildcard credentials to concrete registries","impact":"low","summary":"Edgeless Systems Contrast from 1.21.0 before 1.25.0 has a non-deterministic registry match in imagepuller that sometimes prefers a wildcard entry over a concrete domain. Registry credentials, CA bundles or mirror settings meant for the wildcard may then be used against the concrete registry, leaking credentials or pull metadata.","category":"infrastructure","nicknames":[],"who_cares":["contrast","kubernetes","confidential-containers","container-registries"],"confidence":0.6,"needs_auth":"unknown","worst_case":"registry credentials or CA bundles leak to an unintended registry","analyst_note":"","how_to_check":"- Check the installed Contrast version and whether it is below `1.25.0`\n- Review the imagepuller pull configuration for a concrete registry domain listed alongside a parent wildcard domain entry\n- unknown whether the sources name a specific config file path","needs_analyst":false,"not_affected_if":["version-1.25.0-or-later","no-wildcard-registry-entries"],"who_is_affected":"Teams running Edgeless Systems Contrast from 1.21.0 up to but not including 1.25.0 whose imagepuller pull configuration lists both a concrete registry domain and a wildcard parent domain. Deployments with a single registry or no wildcard entries are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000644,"input_tokens":3374,"output_tokens":613,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116197':13A,16A '-2026':12A,15A '1.21.0':30B,80C '1.25.0':32B,82C 'appli':129C 'bundl':55B,119C 'ca':54B,118C 'concret':9A,50B,69B,100C,110C,132C 'confidenti':18B 'confidential-contain':17B 'configur':97C,106C 'contain':19B,21B,83C 'container-registri':20B 'contrast':1A,23B,28B,78C 'credenti':7A,53B,72B,117C,135C 'cve':11A,14A 'determinist':37B,87C 'domain':51B,101C,111C 'edgeless':26B,76C 'entri':47B,98C 'flaw':90C 'imagepul':41B,92C 'infrastructur':24B 'intend':123C 'kubernet':25B 'leak':71B,134C 'list':107C 'match':39B,102C 'may':63B,127C 'meant':59B 'metadata':75B,138C 'mirror':57B,121C 'non':36B,86C 'non-determinist':35B,85C 'parent':114C 'prefer':44B,95C 'pull':74B,105C,137C 'registri':2A,10A,22B,38B,52B,70B,88C,116C,133C 'select':3A,89C 'send':5A 'set':58B,122C 'sometim':43B 'system':27B,77C 'use':66B 'wildcard':6A,46B,62B,96C,115C,126C","nicknames":[],"mitigations":[],"who_affected":"Teams running Edgeless Systems Contrast from 1.21.0 up to but not including 1.25.0 whose imagepuller pull configuration lists both a concrete registry domain and a wildcard parent domain. Deployments with a single registry or no wildcard entries are not described as exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116197","severity":null,"published_at":"2026-10-25T14:17:00+00:00","modified_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}