CVE-2025-71426 Details

A vulnerability exists in Contrast, a confidential-computing runtime for Kubernetes, in versions prior to 1.4.1. The issue arises because a recovering Coordinator does not validate the seed provided by the recovering party. This flaw allows an attacker to create a rogue Coordinator with a manifest that passes validation, but with a secret seed under the attacker's control. If network traffic is redirected from the legitimate Coordinator to the attacker's, a workload owner can be impersonated. This can occur either by setting a new manifest without comparing the returned root CA certificate to the existing one— which is the default behavior of the Contrast CLI—or by verifying the Coordinator without referencing a trusted root CA certificate. Under these conditions, the attacker can issue certificates that link back to the rogue Coordinator's root CA and access arbitrary workload secrets from deployments after the attack. However, this vulnerability does not impact the legitimate Coordinator's secrets (seed, workload secrets, CA), workload integrity, or certificates that chain back to the mesh CA.

Users can update to Contrast version 1.4.1, where this vulnerability has been patched. Additionally, when using the Contrast CLI, verify the Coordinator's root CA certificate against a trusted reference, especially after 'set' or 'verify' calls.