Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-71425 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:7.3 HIGHVector:CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-532	Insertion of Sensitive Information into Log File	[email protected]

Affected Products

Product	Versions
Edgeless Systems Contrast	<= 1.8.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.8.1moderate effort Mitigation:low effort Set the environment variable `CONTRAST_LOG_LEVEL=warn` for the Contrast initializer and then run `contrast generate` again.

Change History

1 change record found show changes