CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-100833

Contrast (edgelesssys/contrast) versions 1.14.0 through 1.23.0 are vulnerable to container image substitution because generated runtime policies fail to detect certain replacements. The root cause is an allow_storage rule, introduced during a Kata Containers update, that accepts storage entries u...

CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

EUVD-2025-211008

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424

Edgeless Systems Contrast versions up to and including 1.9.0 are vulnerable to an insecure volume mount issue. In bare-metal deployments, the containerd runtime adds a mount point for VOLUME directives defined in a Dockerfile when Kubernetes sets none. This allows an untrusted host to write arbit...

CVE-2025-71422 Contrast before 1.12.1 Insecure LUKS2 Persistent Storage

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

CVE-2025-71422 Contrast before 1.12.1 Insecure LUKS2 Persistent Storage

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

CVE-2025-71422

The Contrast Kubernetes runtime for confidential containers is vulnerable in versions before 1.12.1 . A malicious host can supply a crafted LUKS2 volume to a pod VM. Because LUKS2 volume metadata is not authenticated and older cryptsetup versions (prior to 2.8.1) accept null keyslot encryption al...

CVE-2025-71424: Protection Mechanism Failure

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2026-100833: Improper Input Validation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2025-71422: Improper Verification of Cryptographic Signature

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data

A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workloa...

EUVD-2026-86343

Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment usi...

CVE-2026-47699

A flaw was found in guest-components. This vulnerability allows an attacker to achieve container escape and gain unauthorized access to the underlying pod virtual machine. When unpacking a crafted Open Container Initiative OCI image layer, the archive extraction routine fails to restrict hard lin...

USN-8789-1 strongswan vulnerabilities

It was discovered that strongSwan incorrectly handled PKCS7 containers in the openssl plugin. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. CVE-2026-78123 It was discovered that strongSwan incorrectly handled memory when enumeratin...

CVE-2026-84304 affecting package kata-containers-cc for versions less than 3.15.0.aks0-21

CVE-2026-84304 affecting package kata-containers-cc for versions less than 3.15.0.aks0-21. A patched version of the package is available...

CVE-2026-84445 affecting package kata-containers for versions less than 3.32.0.kata0-6

CVE-2026-84445 affecting package kata-containers for versions less than 3.32.0.kata0-6. An upgraded version of the package is available that resolves this issue...