CVE-2026-116197: Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

Q: Which deployments are exposed to this issue?

Deployments using Edgeless Systems Contrast versions from 1.21.0 before 1.25.0 are affected when imagepuller configuration contains both a concrete registry domain and a parent wildcard entry.

Q: What must be present for credentials or pull metadata to leak?

The relevant configuration must assign credentials, CA bundles, or mirror settings to a wildcard registry entry while also listing a concrete domain that falls under that wildcard. Non-deterministic selection can then apply the wildcard settings to the concrete registry.

Q: Is a default configuration affected?

The issue is conditional on registry pull configuration containing overlapping concrete-domain and parent-wildcard entries. The provided information does not indicate that this configuration is enabled by default.

Q: What is the available remediation?

Upgrade Contrast to version 1.25.0 or later. Until then, avoid configurations that combine a concrete registry domain with its parent wildcard where the wildcard entry contains credentials, CA bundles, or mirror settings.

Published Oct 25, 2026

Updated

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

Affected Software

1 affected component

Edgeless Systems Contrast>=1.21.0<1.25.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Edgeless Systems Contrast to a version that resolves this vulnerability.
Fixed in 1.25.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Edgeless Systems Contrast versions from 1.21.0 before 1.25.0 are affected when imagepuller configuration contains both a concrete registry domain and a parent wildcard entry.

What must be present for credentials or pull metadata to leak?

The relevant configuration must assign credentials, CA bundles, or mirror settings to a wildcard registry entry while also listing a concrete domain that falls under that wildcard. Non-deterministic selection can then apply the wildcard settings to the concrete registry.

Is a default configuration affected?

The issue is conditional on registry pull configuration containing overlapping concrete-domain and parent-wildcard entries. The provided information does not indicate that this configuration is enabled by default.

What is the available remediation?

Upgrade Contrast to version 1.25.0 or later. Until then, avoid configurations that combine a concrete registry domain with its parent wildcard where the wildcard entry contains credentials, CA bundles, or mirror settings.

CVE-2026-116197: Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must be present for credentials or pull metadata to leak?

Is a default configuration affected?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must be present for credentials or pull metadata to leak?

Is a default configuration affected?

What is the available remediation?