CVE-2026-100837: Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary, so a registry entry such as [registries."ghcr.io."] is also applied to any host whose name merely ends in that byte sequence, including attacker-registered domains such as evilghcr.io. When an image or layer is pulled from such a sibling domain, the imagepuller sends the configured Authorization header (basic auth, registry token, or identity token), trusts the configured custom CA bundle, follows the configured mirror, and honours insecure-skip-verify (disabling TLS verification) for that host. Image integrity is not affected, as image bytes remain pinned by digest in the policy and are validated after the pull. Configurations that use a leading dot (e.g., [registries.".example.registry"]) are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Use a leading dot in registry entries to avoid unanchored suffix matching; configurations using a leading dot are unaffected.
Contrast imagepuller registry configuration registry hostname key = Leading-dot hostname, e.g. [registries.".example.registry"]
Event History
Frequently Asked Questions
Which configurations are exposed to credential leakage?
Configurations with a per-registry entry whose name can be matched as an unanchored suffix are exposed. For example, an entry for "ghcr.io." can also match a host such as "evilghcr.io"; entries using a leading dot, such as ".example.registry", are unaffected.
What does an attacker need to exploit this issue?
An attacker needs control of a domain whose hostname ends with the configured registry string and must cause an image or layer to be pulled from that domain. No authentication or user interaction is required under the supplied CVSS vector, but exploitation has high attack complexity.
What information or settings can be exposed to the attacker-controlled host?
The imagepuller can send the configured Authorization header, including basic authentication, registry tokens, or identity tokens. It can also apply the registry's custom CA bundle, configured mirror, and insecure-skip-verify setting to the attacker-controlled host.
Is image integrity affected?
No. Image bytes remain pinned by digest in the policy and are validated after the pull.
What configuration change can mitigate exposure if updating is not immediately possible?
Use registry configuration entries with a leading dot, such as ".example.registry", rather than entries that can be matched as an unanchored suffix. Leading-dot configurations are stated to be unaffected.