CVE-2025-71423 Details

A vulnerability in Edgelesssys Contrast, a confidential-computing runtime for Kubernetes, has been identified in versions 1.9.0 prior to 1.12.2. The issue arises because the initializer logs the complete NewMeshCert response, which includes the workload secret, to standard output at the INFO level. This logging behavior exposes workload secrets to any Kubernetes user with 'get' or 'list' permission on pods/logs. Since workload secrets are utilized for encrypted storage and Vault integration, those aspects must also be considered compromised. This vulnerability represents a regression of a previously addressed issue.

Users can upgrade to Edgelesssys Contrast version 1.12.2 or 1.13.0 to address this vulnerability. However, since the workload secrets are compromised, it is necessary to initialize Contrast from scratch.