CVE-2026-100837

Name of the Vulnerable Software and Affected Versions Contrast (Edgeless Systems) versions prior to 1.20.1

Description The imagepuller performs unanchored suffix matching when selecting per-registry configuration. The Config.registryFor function strips a single trailing dot and uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary. This allows a registry entry like [registries."ghcr.io."] to be applied to any host ending in that sequence, such as evilghcr.io. Consequently, when pulling an image or layer from such a domain, the imagepuller may send the configured Authorization header, trust a custom CA bundle, follow a configured mirror, or disable TLS verification via insecure-skip-verify. Image integrity is maintained as bytes are pinned by digest and validated after the pull. Configurations using a leading dot are not affected.

Recommendations Update to version 1.20.1 or later.