CVE-2026-100838 edgelesssys CVE debrief

Who should care

Defenders responsible for Kubernetes deployments using Contrast should assess exposure and prioritize upgrading to version 1.19.1 or later. Those unable to upgrade should apply an equivalent rego policy fix passed to 'contrast generate --policy'.

Why it matters

CVE-2026-100838 is a high-severity vulnerability in Contrast, a confidential-computing runtime for Kubernetes. Defenders should prioritize upgrading to version 1.19.1 or later to prevent potential arbitrary writes to the guest root filesystem and disclosure of sensitive data.

• Potential for arbitrary writes to the guest root filesystem
• Possible disclosure of sensitive data
• Full guest takeover by a malicious process on the untrusted host

Technical summary

The Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could issue a series of CopyFile requests to overwrite security-critical files in the guest or trick the workload into disclosing sensitive data. This vulnerability affects Contrast versions before 1.19.1, and defenders should prioritize upgrading to this version or later to prevent potential arbitrary writes to the guest root filesystem and disclosure of sensitive data.

Defensive priority

Defenders should prioritize upgrading to Contrast version 1.19.1 or later. For those unable to upgrade, applying an equivalent rego policy fix passed to 'contrast generate --policy' can mitigate the vulnerability.

Recommended defensive actions

• Upgrade to Contrast version 1.19.1 or later
• Apply an equivalent rego policy fix passed to 'contrast generate --policy' for those unable to upgrade
• Review and update affected deployments to ensure version 1.19.1 or later is used
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. The vendor, edgelesssys, has provided a GitHub Security Advisory (GHSA-rh99-wc69-c255) and VulnCheck has provided a third-party advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.