CVE-2026-100833: Contrast before 1.23.1 Image Substitution via Policy Generation

Vulnerability summary

CVE-2026-100833 is a critical (CVSS 9.6) Improper Input Validation vulnerability in edgelesssys contrast. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.

Timeline

1. 27-09-2026
   PublishedVulnerability first disclosed.
2. 09-10-2026
   Last modifiedVulnerability information updated.

Description

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.