CVE-2025-71426 | CVSS: 7.1 | 严重级别: HIGH
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recovering party. An attacker can therefore stand up a rogue Coordinator whose manifest passes validation but whose secret seed is attacker-controlled. If network traffic is redirected from the legitimate Coordinator to the attacker's Coordinator, a workload owner can be impersonated when they either set a new manifest without comparing the returned root CA certificate against the existing one (the default behavior of the contrast CLI) or veri
参考链接:
• https://github.com/edgelesssys/contrast/security/advisories/GHSA-vqv5-385r-2hf8
• https://www.vulncheck.com/advisories/contrast-before-1.4.1-coordinator-impersona
📌 数据来源: NVD 官方