CVE-2025-71426

{"id": "CVE-2025-71426", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71426", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T15:13:57.532066Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "edgelesssys", "product": "contrast", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.1", "versionType": "semver"}, {"status": "unaffected", "version": "1.4.1", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/edgelesssys/contrast", "defaultStatus": "unaffected"}]}], "published": "2026-09-27T02:17:17.160", "references": [{"url": "https://github.com/edgelesssys/contrast/security/advisories/GHSA-vqv5-385r-2hf8", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/contrast-before-1.4.1-coordinator-impersonation-via-unauthenticated-recovery", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recovering party. An attacker can therefore stand up a rogue Coordinator whose manifest passes validation but whose secret seed is attacker-controlled. If network traffic is redirected from the legitimate Coordinator to the attacker's Coordinator, a workload owner can be impersonated when they either set a new manifest without comparing the returned root CA certificate against the existing one (the default behavior of the contrast CLI) or verify the Coordinator without comparing the root CA certificate against a trusted reference. Under these conditions the attacker can issue certificates that chain back to the rogue Coordinator's root CA and recover arbitrary workload secrets of workloads deployed after the attack. Secrets of the legitimate Coordinator (seed, workload secrets, CA), workload integrity, and certificates chaining to the mesh CA are not affected."}, {"lang": "es", "value": "Contrast es un entorno de ejecuci\u00f3n de computaci\u00f3n confidencial para Kubernetes. En versiones anteriores a la 1.4.1, un Coordinador en recuperaci\u00f3n no verifica la semilla proporcionada por la parte en recuperaci\u00f3n. Un atacante puede, por lo tanto, establecer un Coordinador malicioso cuyo manifiesto pasa la validaci\u00f3n, pero cuya semilla secreta est\u00e1 controlada por el atacante. Si el tr\u00e1fico de red se redirige del Coordinador leg\u00edtimo al Coordinador del atacante, se puede suplantar a un propietario de carga de trabajo cuando este establece un nuevo manifiesto sin comparar el certificado de CA ra\u00edz devuelto con el existente (el comportamiento predeterminado de la CLI de Contrast) o verifica el Coordinador sin comparar el certificado de CA ra\u00edz con una referencia de confianza. Bajo estas condiciones, el atacante puede emitir certificados que se encadenan a la CA ra\u00edz del Coordinador malicioso y recuperar secretos arbitrarios de cargas de trabajo desplegadas despu\u00e9s del ataque. Los secretos del Coordinador leg\u00edtimo (semilla, secretos de cargas de trabajo, CA), la integridad de las cargas de trabajo y los certificados que se encadenan a la CA de la malla no se ven afectados."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "disclosure@vulncheck.com"}