CVE-2026-116197 Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116197?
CVE-2026-116197 is a low-severity vulnerability in edgelesssys contrast, published on 25 Oct 2026.
Official description
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
Weakness: CWE-1289
Which versions are affected by CVE-2026-116197?
How do I fix CVE-2026-116197?
No fix has been published for CVE-2026-116197 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116197 being exploited?
There is no known exploitation of CVE-2026-116197 in the wild and no public exploit code.
Sources
Also known as GHSA-w4p9-c7h8-jvgr, GHSA-xx94-cp2x-w69r.