CVE-2026-100837

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

EUVD-2026-87832

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100837

Contrast versions through 1.20.0 by Edgeless Systems are vulnerable to a credential leak due to unanchored suffix matching in the imagepuller component. The Config.registryFor function strips a trailing dot and uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary. This al...

CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100837: Improper Validation of Unsafe Equivalence in Input

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

GO-2026-5865 Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast...

GHSA-6C87-G9PW-78FX Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries

Summary Config.registryFor selected a per-registry credential / CA / mirror block by checking strings.HasSuffixname, fqdn after stripping a single trailing dot. The match has no boundary between the configured FQDN and any preceding characters in the request hostname. A registry configured as...