DailyCVE@dailycve
🔴 Contrast, Insecure Image Digest Verification, #CVE-2026-100833 (HIGH) -DC-Oct2026-2794 https://dailycve.com/contrast-insecure-image-digest-verification-cve-2026-100833-high-dc-oct2026-2794/
0000025
238 followersView on X
CVE-2026-100833
LOWCVSS 7.6 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-20
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day