CVE-2026-100836: Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be an authenticated workload with a valid mesh certificate. Unauthenticated network clients are not described as able to trigger it.
What is the practical impact?
A crafted short base64-encoded ciphertext can cause a runtime panic in the transit-engine endpoint. The reported effects are log spam and request failures; the process does not crash.
Are deployments affected by default?
The issue is present in Contrast through version 1.20.0, but the available information does not state whether the affected transit-engine endpoint is enabled or reachable in a default deployment.
What can be done before patching?
Restrict access to the affected endpoint to trusted workloads and review which workloads hold valid mesh certificates. The vulnerability requires an authenticated workload certificate, so limiting those credentials reduces exposure.