Executive brief
Contrast is a confidential-computing runtime that manages encrypted workloads in Kubernetes clusters. Versions before 1.4.1 fail to verify the identity of recovering Coordinators, allowing an attacker to impersonate the legitimate Coordinator through network redirection and trick workload owners into using the attacker's system. This enables the attacker to issue forged certificates and steal secrets of workloads deployed after the attack, provided the user skips the default verification step.
Technical details
The Coordinator recovery mechanism accepts a seed value from the recovering party without cryptographic verification, enabling an attacker to deploy a rogue Coordinator with a valid manifest but attacker-controlled secrets. If network traffic is redirected and users fail to compare the returned root CA certificate against a trusted reference (default contrast CLI behavior), the attacker can issue fraudulent certificates and recover arbitrary workload secrets. The legitimate Coordinator's secrets, workload integrity, and mesh CA remain unaffected.
Affected products
- Edgeless Systems Contrast before 1.4.1
Timeline
- 2025-02-05: disclosed
- 2025-02-05: patched: Version 1.4.1 released