CVE-2026-109359: Insufficient Verification of Data Authenticity in edgelesssys contrast

CVE-2026-109359 describes an improper verification vulnerability in edgelesssys contrast's Coordinator peer recovery mechanism. The system fails to confirm that the serving peer uses the same manifest generation, enabling attackers with write access to manifest history to replay superseded history heads. This can result in withdrawn workloads obtaining trusted mesh certificates improperly. Furthermore, possession of the secret seed by an attacker could lead to disclosure of the Mesh CA key. The affected versions are contrast 1.8.0 through 1.24.0 inclusive. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Attackers with write access to the manifest history can replay outdated manifest states, causing withdrawn workloads to receive trusted mesh certificates, which undermines trust in the mesh network. If the secret seed is compromised, the attacker can disclose the Mesh CA key, potentially allowing broader compromise of the mesh certificate authority and further undermining system security.

The vulnerability affects contrast versions from 1.8.0 up to but not including 1.24.1. Users should upgrade to version 1.24.1 or later where this issue is fixed. Since this is not a cloud service, remediation requires applying the official patch or upgrade provided by edgelesssys. Patch status is confirmed by the affectedVersions field indicating fixed in 1.24.1. No vendor advisory content was provided, so check the vendor's official channels for the patch and further guidance.