CVE-2026-109359— Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery
Quick assessment
Affected
edgelesssys contrast
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Contrast 1.8.0 至 1.24.1（不含 1.24.1）在 Coordinator 对等节点恢复过程中存在一个不正确的验证漏洞，该漏洞未能确认当前服务的对等节点是否使用了相同的清单（manifest）生成版本。拥有清单历史记录写权限的攻击者可以重放已被替换的历史记录头，从而使已撤销的工作负载获得可信的 Mesh 证书；或者，通过暴露秘密种子，泄露 Mesh CA（证书颁发机构）密钥。
Possible ATT&CK Techniques 1 AI
T1195.001 · Compromise Software Dependencies and Development ToolsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| edgelesssys | contrast | 1.8.0< 1.24.1 |
affected |
1.24.1 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109359
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery
Source: CVE Program / CVE List V5
Vulnerability Description
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| edgelesssys | contrast | 1.8.0 ~ 1.24.1 | - |
|
II. Public POCs for CVE-2026-109359
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109359
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109359 (2)
IV. Related Vulnerabilities
Same product: contrast
-
CVE-2026-109358
Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable -
CVE-2026-100837
Edgeless Systems Contrast through 1.20.0 Credential Leak via -
CVE-2026-100836
Edgeless Systems Contrast through 1.20.0 Denial of Service v -
CVE-2026-100839
Contrast before 1.18.0 AML Injection Remote Code Execution -
CVE-2026-100838
Contrast before 1.19.1 CopyFile Policy Symlink Subversion
Same vendor: edgelesssys
-
CVE-2026-109358
Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable -
CVE-2026-100837
Edgeless Systems Contrast through 1.20.0 Credential Leak via -
CVE-2026-100836
Edgeless Systems Contrast through 1.20.0 Denial of Service v -
CVE-2026-100839
Contrast before 1.18.0 AML Injection Remote Code Execution -
CVE-2026-100838
Contrast before 1.19.1 CopyFile Policy Symlink Subversion
Same weakness: CWE-345
-
CVE-2026-55103
Discourse ActivityPub: Fix inbound actor validation and appl -
CVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can -
CVE-2026-102695
OmniFaces: Forged combined-resource IDs and related output/p -
CVE-2026-110607
BizSpring Shop through commit cf22d39daaf1 Payment Bypass vi -
CVE-2026-102250
TP-Link固件版本数据真实性校验绕过致设备控制权丢失
V. Comments for CVE-2026-109359
No comments yet