Contrast is a confidential-computing runtime for Kubernetes. (CVE-2026-100838)
Contrast is a confidential-computing runtime for Kubernetes. Versions before 1.19.1 have a vulnerability in the Kata agent policies generated by the Contrast CLI, where a flaw in the CopyFile verification allows arbitrary writes to the guest root filesystem. This flaw enables a malicious process on the untrusted host with access to the Kata agent VSOCK to overwrite security-critical files or cause sensitive data disclosure, potentially leading to full guest takeover. Users unable to upgrade can apply a rego policy fix via the 'contrast generate --policy' command.
AI Analysis
Technical Summary
Contrast's confidential-computing runtime for Kubernetes versions prior to 1.19.1 contains a vulnerability (CVE-2026-100838) in the Kata agent policies generated by the Contrast CLI. The flaw lies in the CopyFile verification process, which can be exploited by a malicious process on the untrusted host that can connect to the Kata agent VSOCK interface. By issuing a series of CopyFile requests, the attacker can perform arbitrary writes to the guest root filesystem, overwriting security-critical files or causing the workload to disclose sensitive information. This vulnerability effectively allows a full guest takeover. A remediation is available in version 1.19.1, and an equivalent rego policy fix can be applied for users unable to upgrade.
Potential Impact
The vulnerability allows an attacker with access to the Kata agent VSOCK on the untrusted host to perform arbitrary writes to the guest root filesystem. This can lead to overwriting security-critical files or tricking the workload into disclosing sensitive data, resulting in a full guest takeover. The CVSS score of 8.1 (high severity) reflects the significant confidentiality and integrity impact, with no required privileges or user interaction.
Mitigation Recommendations
A fixed version 1.19.1 is available that addresses this vulnerability. Users unable to upgrade can apply an equivalent rego policy fix by passing it to the 'contrast generate --policy' command. No other mitigation steps are indicated.
Contrast is a confidential-computing runtime for Kubernetes. (CVE-2026-100838)
Description
Contrast is a confidential-computing runtime for Kubernetes. Versions before 1.19.1 have a vulnerability in the Kata agent policies generated by the Contrast CLI, where a flaw in the CopyFile verification allows arbitrary writes to the guest root filesystem. This flaw enables a malicious process on the untrusted host with access to the Kata agent VSOCK to overwrite security-critical files or cause sensitive data disclosure, potentially leading to full guest takeover. Users unable to upgrade can apply a rego policy fix via the 'contrast generate --policy' command.
CVSS v3.1
Score 8.1high
Affected software
pkg:github/edgelesssys/contrastRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Contrast's confidential-computing runtime for Kubernetes versions prior to 1.19.1 contains a vulnerability (CVE-2026-100838) in the Kata agent policies generated by the Contrast CLI. The flaw lies in the CopyFile verification process, which can be exploited by a malicious process on the untrusted host that can connect to the Kata agent VSOCK interface. By issuing a series of CopyFile requests, the attacker can perform arbitrary writes to the guest root filesystem, overwriting security-critical files or causing the workload to disclose sensitive information. This vulnerability effectively allows a full guest takeover. A remediation is available in version 1.19.1, and an equivalent rego policy fix can be applied for users unable to upgrade.
Potential Impact
The vulnerability allows an attacker with access to the Kata agent VSOCK on the untrusted host to perform arbitrary writes to the guest root filesystem. This can lead to overwriting security-critical files or tricking the workload into disclosing sensitive data, resulting in a full guest takeover. The CVSS score of 8.1 (high severity) reflects the significant confidentiality and integrity impact, with no required privileges or user interaction.
Mitigation Recommendations
A fixed version 1.19.1 is available that addresses this vulnerability. Users unable to upgrade can apply an equivalent rego policy fix by passing it to the 'contrast generate --policy' command. No other mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h734-rggh-79xq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100838"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ab89bc2f7a7c54106941ecf
Added to database: 09/27/2026, 04:29:54 UTC
Last enriched: 09/27/2026, 04:36:19 UTC
Last updated: 09/27/2026, 06:47:53 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.