CVE-2026-109359: Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs write access to manifest history to replay a superseded history head. Disclosure of the Mesh CA key additionally requires access to the secret seed.
What is the impact of replaying a superseded manifest history head?
Withdrawn workloads can obtain trusted mesh certificates. This can allow those workloads to be trusted within the mesh despite having been withdrawn.
Which deployments are affected?
Contrast versions from 1.8.0 up to, but not including, 1.24.1 are affected. The issue is in Coordinator peer recovery.