Contrast initializer: workload secrets logged to Kubernetes pod logs at the default log level

Impact

The Contrast initializer writes the workload secret to stderr, which Kubernetes captures as pod logs. Because info is the default log level, installations that never touched CONTRAST_LOG_LEVEL are affected. Workload secrets back encrypted storage and Vault integration, so anyone with get or list on pods/log - a broad, commonly granted RBAC verb - or read access to wherever the cluster ships its logs, including the cloud provider, obtains material that decrypts tenant data. On a multi-tenant GPU cluster that means a namespace-scoped tenant or an observability pipeline can read secrets the confidential-computing design intended to keep from the platform operator entirely. The record notes this issue recurred later as CVE-2025-71423 in the 1.9.0-1.12.2 range; deployments that do not use workload secrets are unaffected.

Who can reach it

Any authenticated Kubernetes principal with get or list on pods/log in the workload namespace, or anyone with read access to the cluster's log storage or the cloud provider's logging backend. No exploit, only a log read.

What to do

Upgrade Contrast to 1.8.1 or later and redeploy affected workloads so the initializer runs the fixed code. Treat every workload secret that was ever logged as compromised: rotate the secrets, re-key anything encrypted under them, rotate the Vault material they unlocked, and purge or restrict the retained pod logs and any log-aggregation copies. Rotation, not the upgrade, is the expensive part. Cost is a workload redeploy plus credential rotation; no node maintenance.

References

Related entries

• RHACS: deploy-time policy enforcement bypassed by a crafted deployment config labelCVE-2026-10079 · Red Hat Advanced Cluster Security for Kubernetes (deployment identity handling)High
• Telepresence Traffic Manager: any in-cluster pod can intercept traffic and read pod environmentsCVE-2026-102340 · Telepresence Traffic Manager (unauthenticated gRPC API on port 8081)High
• Contrast: node installer writes containerd config world-writable, giving local users node takeoverCVE-2026-109358 · Edgeless Systems Contrast (node installer, containerd config file permissions)High
• Kyverno verifyImages: cache keyed by tag, not digest, lets a moved tag admit an unverified imageCVE-2026-122321 · Kyverno verifyImages (signature verification cache keyed by image reference)High
• LXD: crafted image templates escape the instance template directory and read or create host filesCVE-2026-16033 · LXD (image metadata template handling, QEMU/VM driver paths)High
• RHACM cluster-proxy: caller-supplied impersonation headers grant cluster-admin on managed clustersCVE-2026-17107 · Red Hat ACM / multicluster-engine cluster-proxy (service-proxy impersonation headers)High