Go/github.com/edgelesssys/contrast CVE-2026-100837: low 3.7, EPSS 0.21%
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries
Action: Upgrade github.com/edgelesssys/contrast to 1.21.0 or later.
go get github.com/edgelesssys/contrast@v1.21.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.21.0 | - |
Fixed versions
| 1.21.0 |
Sources
- osv: GHSA-6c87-g9pw-78fx
- https://github.com/edgelesssys/contrast/security/advisories/GHSA-6c87-g9pw-78fx
- https://github.com/edgelesssys/contrast/commit/10826b1d82613025767fb094e8aa51a7dcfbd2a1
- https://github.com/edgelesssys/contrast
- https://github.com/edgelesssys/contrast/releases/tag/v1.21.0
CVE-2026-100837 · published · modified · JSON