{"answers":{"affected":"3 open source packages ship an affected version, including github.com/edgelesssys/contrast.","exploited":"There is no known exploitation of CVE-2026-100838 in the wild and no public exploit code.","fix":"Upgrade github.com/edgelesssys/contrast to 1.19.1 or later.","what":"CVE-2026-100838 is a high-severity path traversal vulnerability in edgelesssys contrast, published on 27 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-100838 and fix it if it is affected.\n\nWhat it is: CVE-2026-100838 is a high-severity path traversal vulnerability in edgelesssys contrast, published on 27 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-100838 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/edgelesssys/contrast (Go): affected all versions; fixed in 1.19.1\n- github.com/edgelesssys/contrast (Go): affected all versions; fixed in 1.19.1\n- github.com/edgelesssys/contrast (Go): affected all versions; fixed in 1.19.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-100838/ (Markdown: https://insights.sbomify.com/CVE-2026-100838/index.md)","id":"CVE-2026-100838","markdown":"https://insights.sbomify.com/CVE-2026-100838/index.md","name":"CVE-2026-100838","record":{"aliases":["GHSA-h734-rggh-79xq","GHSA-rh99-wc69-c255","GO-2026-5624"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"upgrade","impacts":["code_execution","data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Kubernetes confidential computing","requires_auth":"none","summary":"A malicious host process can overwrite guest filesystem files via symlink subversion in Contrast, leading to guest takeover and data disclosure.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"description":"Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could issue a series of CopyFile requests to overwrite security-critical files in the guest or trick the workload into disclosing sensitive data, effectively amounting to a full guest takeover. Users unable to upgrade can apply an equivalent rego policy fix passed to 'contrast generate --policy'.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Contrast before 1.19.1 CopyFile Policy Symlink Subversion","id":"CVE-2026-100838","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"Contrast before 1.18.0 AML Injection Remote Code Execution","id":"CVE-2026-100839"},"packages":[{"ecosystem":"Go","fixed":["1.19.1"],"introduced":["0"],"last_affected":[],"package":"github.com/edgelesssys/contrast","purl":null,"source":"GHSA-rh99-wc69-c255"},{"ecosystem":"Go","fixed":["1.19.1"],"introduced":["0"],"last_affected":[],"package":"github.com/edgelesssys/contrast","purl":"pkg:golang/github.com/edgelesssys/contrast","source":"GHSA-rh99-wc69-c255"},{"ecosystem":"Go","fixed":["1.19.1"],"introduced":["0"],"last_affected":[],"package":"github.com/edgelesssys/contrast","purl":"pkg:golang/github.com/edgelesssys/contrast","source":"GO-2026-5624"}],"prev":{"headline":"Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching","id":"CVE-2026-100837"},"products":["contrast"],"published":"2026-09-27","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-08","vendors":["edgelesssys"]},"summary":"A malicious host process can overwrite guest filesystem files via symlink subversion in Contrast, leading to guest takeover and data disclosure.","url":"https://insights.sbomify.com/CVE-2026-100838/"}