Contrast initializer: regression re-exposes workload secrets by logging the full NewMeshCert response

Impact

In Contrast 1.9.0 through 1.12.2 the initializer logs the entire NewMeshCert response at INFO, and that response carries the workload secret - a regression of the earlier fix tracked as GHSA-h5f8-crrq-4pw8 (see the related entry for CVE-2025-71425). Any Kubernetes user with get or list on pods/log reads the secret straight out of the log stream, and because workload secrets are used for encrypted storage and Vault integration, everything derived from them must be considered compromised too. Kept separate from the earlier issue because the affected version range and the logging site differ: an operator who patched once still needs to check whether they landed in the reintroduced window.

Who can reach it

Any authenticated Kubernetes principal with get or list on pods/log for the namespace running the initializer, plus anyone able to read the cluster's shipped logs. Requires low privilege, no exploitation.

What to do

Upgrade to Contrast 1.12.2 or later and redeploy the workloads so the initializer stops emitting the secret. Then rotate every workload secret exposed while an affected version ran, re-key encrypted storage and the Vault integration behind it, and purge the pod logs and downstream log copies that captured it. Workload redeploy plus secret rotation; no node drain or reboot.

References

Related entries

• Contrast initializer: workload secrets logged to Kubernetes pod logs at the default log levelCVE-2025-71425 · Contrast initializer (workload secret written to stderr at default log level)High
• RHACS: deploy-time policy enforcement bypassed by a crafted deployment config labelCVE-2026-10079 · Red Hat Advanced Cluster Security for Kubernetes (deployment identity handling)High
• Telepresence Traffic Manager: any in-cluster pod can intercept traffic and read pod environmentsCVE-2026-102340 · Telepresence Traffic Manager (unauthenticated gRPC API on port 8081)High
• Contrast: node installer writes containerd config world-writable, giving local users node takeoverCVE-2026-109358 · Edgeless Systems Contrast (node installer, containerd config file permissions)High
• Kyverno verifyImages: cache keyed by tag, not digest, lets a moved tag admit an unverified imageCVE-2026-122321 · Kyverno verifyImages (signature verification cache keyed by image reference)High
• LXD: crafted image templates escape the instance template directory and read or create host filesCVE-2026-16033 · LXD (image metadata template handling, QEMU/VM driver paths)High