---
id: "CVE-2026-116197"
kind: "vulnerability"
aliases: ["CVE-2026-116197"]
title: "Contrast: registry selection can send wildcard credentials to concrete registries"
severity: "low"
cvss: 2.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["confidential-containers", "container-registries", "contrast", "infrastructure", "kubernetes"]
not_affected_if: ["no-wildcard-registry-entries", "version-1.25.0-or-later"]
published_at: "2026-10-25T14:17:00+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:44:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116197", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# Contrast: registry selection can send wildcard credentials to concrete registries

Edgeless Systems Contrast from 1.21.0 before 1.25.0 has a non-deterministic registry match in imagepuller that sometimes prefers a wildcard entry over a concrete domain. Registry credentials, CA bundles or mirror settings meant for the wildcard may then be used against the concrete registry, leaking credentials or pull metadata.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Contrast version and whether it is below `1.25.0`
- Review the imagepuller pull configuration for a concrete registry domain listed alongside a parent wildcard domain entry
- unknown whether the sources name a specific config file path

## Fix

- Upgrade Contrast to `1.25.0` or later
- Rotate any registry credentials that were configured under a wildcard entry if a concrete registry sharing that parent domain was in use

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116197

## From the sources

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_