CVE-2026-116197 in Contrast
Summary
by MITRE • 10/25/2026
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Edgeless Systems Contrast versions prior to 1.25.0 represents a critical flaw within the imagepuller component's logic for selecting container registries and applying associated configurations. This issue stems from a non-deterministic selection mechanism that fails to strictly prioritize specific domain matches over broader wildcard patterns when multiple configuration entries are present in the pull settings. In standard network routing and security policy applications, specificity should always take precedence; however, this implementation allows the system to arbitrarily select a parent wildcard entry even when a more precise concrete domain match exists for the target registry. This deviation from expected hierarchical resolution logic creates an environment where sensitive operational data can be inadvertently exposed or misapplied during container image retrieval operations.
The technical core of this flaw lies in how the configuration parser resolves conflicts between explicit host definitions and glob-based patterns. When a user defines both a specific registry address, such as internal.company.com, and its parent wildcard pattern, *.company.com, along with distinct credentials or certificate authorities for each, the system does not guarantee that the concrete entry will be selected. Instead, due to non-deterministic behavior in the selection algorithm, there is a risk that the wildcard configuration takes precedence. This means that authentication tokens, private keys, or custom Certificate Authority bundles intended exclusively for broader, perhaps less secure or different operational contexts associated with the wildcard pattern may be applied to requests targeting the specific concrete registry.
The operational impact of this vulnerability is significant from both a security and compliance perspective. The primary risk involves credential leakage, where sensitive authentication data meant for one scope is exposed in the context of another. If an attacker can influence or observe the non-deterministic selection process, they may gain access to credentials that were not intended for the specific registry being accessed. Furthermore, this misconfiguration can lead to man-in-the-middle attack vectors if incorrect Certificate Authority bundles are applied, potentially allowing traffic interception without detection. Additionally, mirror settings intended for one domain might be incorrectly routed through another, disrupting supply chain integrity and violating strict isolation policies required in secure container orchestration environments.
This vulnerability aligns with CWE-20 Improper Input Validation as it reflects a failure to correctly validate and prioritize configuration inputs based on specificity rules. It also relates to CWE-798 Use of Hard-coded Credentials if the wildcard credentials are less secure than those intended for specific registries, or more broadly to information disclosure flaws where sensitive data is exposed in an unintended context. From an ATT&CK perspective, this behavior facilitates Initial Access and Credential Access techniques by potentially exposing authentication material that could be harvested during image pull operations within a compromised node environment.
To mitigate this risk, organizations running Edgeless Systems Contrast must upgrade immediately to version 1.25.0 or later where the registry selection logic has been corrected to enforce strict precedence for concrete domain matches over wildcard entries. Until an update is applied, administrators should audit their imagepuller configurations to ensure that no overlapping patterns exist between specific registries and broader wildcards with differing credentials or security settings. It is also advisable to implement network-level segmentation and monitor container runtime logs for anomalies in registry connection attempts that might indicate the incorrect application of wildcard-based authentication tokens. Regular audits of configuration files against best practices for least privilege and explicit domain targeting will further reduce the attack surface associated with this type of logic error.