CVE-2026-109359 Details

A vulnerability has been identified in Contrast versions 1.8.0 prior to 1.24.1, involving improper verification during Coordinator peer recovery. The issue arises because the recovery process does not ensure that the serving peer is using the same manifest generation as the recovering Coordinator. This flaw allows attackers with write access to the Coordinator's manifest history to replay a previously valid history head, enabling the adoption of a superseded manifest. As a result, withdrawn workloads can obtain trusted mesh certificates, or, if the secret seed is available, disclose the Mesh CA key.

Users can upgrade to Contrast version 1.24.1, where this vulnerability has been patched. The Mesh API recovery response now includes the serving Coordinator's latest transition hash, and a recovering Coordinator will only proceed if that hash matches the history head it is recovering to. This ensures that a Mesh CA key is only valid for the transition it was generated for. No complete workaround is available, but restricting write access to the Coordinator's manifest history and separating custody of the secret seed from Kubernetes administrative access can reduce the risk.