CVE-2025-71425 | BDVDB-2026-379964 Detail

Description#

Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-27Record published in the CVE List.
2. Version 22026-10-08Most recent update recorded in the CVE List.