CVE-2026-100838

Name of the Vulnerable Software and Affected Versions Contrast versions prior to 1.19.1

Description Kata agent policies generated by the Contrast CLI contain a flaw in the CopyFile verification process. This allows arbitrary writes to the guest root filesystem. A malicious process on an untrusted host with access to the Kata agent VSOCK can issue multiple CopyFile requests to overwrite security-critical files or induce the workload to disclose sensitive data, potentially leading to a full guest takeover.

Recommendations Update to version 1.19.1 or later. As a temporary workaround, apply an equivalent rego policy fix using the contrast generate --policy command.