Contrast (Edgeless Systems) prior to version 1.8.1 has a vulnerability where the workload secret is logged to stderr by the Contrast initializer if the environment variable CONTRAST_LOG_LEVEL is set to info or debug. Because info is the default log level, this results in workload secrets being recorded in Kubernetes logs. These secrets are intended to be accessible only to the Contrast Coordinator, initializer, seedshare owner, and workload owner. However, due to this logging behavior, any Kubernetes user with get or list permissions on pods/logs or any entity with read access to Kubernetes log storage (including cloud providers) can access these secrets. Deployments that do not utilize workload secrets are unaffected by this issue.

The vulnerability exposes sensitive workload secrets to unauthorized parties who have access to Kubernetes logs, either through Kubernetes permissions or cloud provider log storage access. This can lead to compromise of workload confidentiality and potentially further unauthorized access or actions within the Kubernetes environment. The CVSS score is 7.3 (high severity), reflecting the ease of access and high confidentiality impact. There is no indication of impact on integrity or availability.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, users should consider customizing the CONTRAST_LOG_LEVEL to a level that does not log secrets (e.g., setting it above info/debug) or avoid using workload secrets until a fix is available. Additionally, restrict Kubernetes permissions to limit access to pod logs and secure log storage access to trusted entities only.