[ CVE-2026-116197 · Published 25 Oct 2026 ]
Vulnerability in edgelesssys contrast
CVSS 2.6
EPSS <1%No fix listed yet
[ Description ]Official description
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.