Contrast: Improper verification of manifest generation in Coordinator peer recovery

Summary

Contrast versions 1.8.0 up to 1.24.0 do not verify that a peer used for Coordinator recovery serves the same manifest generation. An attacker with write access to the manifest history can replay a superseded history head, so withdrawn workloads can obtain trusted mesh certificates. An attacker who additionally holds the secret seed can disclose the Mesh CA key.

Affected

• Contrast 1.8.0 up to and including 1.24.0 (before 1.24.1)

Fixed in

• Contrast 1.24.1

Workaround

• No complete workaround is available.
• Restrict write access to the Coordinator's manifest history.
• Separate custody of the secret seed from Kubernetes administrative access.
• Run contrast verify to detect the resulting state.

Exploitation

• No known exploitation in the wild.
• No public proof of concept found; this is unverified.
• CISA SSVC: exploitation none, not automatable, partial technical impact.
• EPSS: 0.0011.

Our recommendation

• Check whether Contrast is deployed at all, for example in lockfiles and deployed manifests.
• If deployed, upgrade to 1.24.1 or later.
• Review who holds write access to Coordinator manifest history and who holds the secret seed.
• Run contrast verify after the upgrade and monitor for manifest mismatches.
• If not deployed, no action beyond normal tracking.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-rxcv-p3px-m3c3 github.com
• VulnCheck advisory www.vulncheck.com
• Contrast release v1.24.1 github.com
• OSV CVE-2026-109359 osv.dev
• Vulners NVD:CVE-2026-109359 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:45.