CVE-2026-100838 Contrast before 1.19.1 CopyFile Policy Symlink Subversion
A malicious host process can overwrite guest filesystem files via symlink subversion in Contrast, leading to guest takeover and data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100838?
CVE-2026-100838 is a high-severity path traversal vulnerability in edgelesssys contrast, published on 27 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could issue a series of CopyFile requests to overwrite security-critical files in the guest or trick the workload into disclosing sensitive data, effectively amounting to a full guest takeover. Users unable to upgrade can apply an equivalent rego policy fix passed to 'contrast generate --policy'.
Weakness: CWE-59
Which versions are affected by CVE-2026-100838?
3 open source packages ship an affected version, including github.com/edgelesssys/contrast.
| Package | Affected | Fixed in |
|---|---|---|
github.com/edgelesssys/contrast Go | All versions | 1.19.1 |
github.com/edgelesssys/contrast Go | All versions | 1.19.1 |
github.com/edgelesssys/contrast Go | All versions | 1.19.1 |
How do I fix CVE-2026-100838?
Upgrade github.com/edgelesssys/contrast to 1.19.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-100838 being exploited?
There is no known exploitation of CVE-2026-100838 in the wild and no public exploit code.
Sources
Also known as GHSA-h734-rggh-79xq, GHSA-rh99-wc69-c255, GO-2026-5624.