CVE-2025-71425: Contrast before 1.8.1 Information Disclosure via Logging
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contrast (Edgeless Systems)to a version that resolves this vulnerability.Fixed in 1.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using workload secrets are exposed when the Contrast initializer log level is set to info or debug. Since info is the default, installations that have not customized the initializer log level are affected.
Who could access the disclosed workload secret?
Kubernetes users with get or list permission on pods/logs can access the logged secret. Anyone with read access to the Kubernetes log storage, including the cloud provider, may also be able to access it.
What access does an attacker need to obtain the secret?
An attacker needs access to Kubernetes pod logs or to the underlying log storage. The issue does not require access to the Contrast Coordinator, initializer, seedshare owner, or workload owner if the secret has already been written to logs.
Are deployments that do not use workload secrets affected?
No. Deployments that do not use workload secrets are unaffected.
What can be done if upgrading is not immediately possible?
Configure the Contrast initializer log level so it is not set to info or debug. Restrict access to pod logs and Kubernetes log storage, and treat existing logs as potentially containing exposed workload secrets.