Improper Verification Vulnerability in Contrast by Edgeless Systems
CVE-2026-109359

8.7HIGH

Key Information:

Vendor

Edgelesssys

Status
Contrast
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109359?

Contrast versions prior to 1.24.1 are affected by an improper verification vulnerability in the Coordinator peer recovery process. The flaw allows attackers with write access to the manifest history to replay a superseded history head. This can lead to withdrawn workloads incorrectly obtaining trusted mesh certificates. Moreover, if the attacker possesses the secret seed, there is a risk of disclosing the Mesh CA key, significantly compromising the system's integrity.

Affected Version(s)

contrast 1.8.0 < 1.24.1

contrast 1.24.1

References

https://github.com/edgelesssys/contrast/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/contrast-1.8.0-befor...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sjlnk
sespiros
burgerdev
.