Is CVE-2026-100833 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100833 being exploited in the wild.

How severe is CVE-2026-100833?

High severity, with a CVSS score of 8.2, published 27 September 2026.

Which products and versions are affected?

Edgeless Systems Contrast 1.14.0 through 1.23.0.

Is there a fix for CVE-2026-100833?

A patch was published on 2026-09-27: Patches available in v1.23.1 and v1.24.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100833 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100833?

Check whether you run Edgeless Systems Contrast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100833: Edgeless Systems Contrast runtime policy image substitution in policy generation

CVE-2026-100833 · Severity: high · CVSS 8.2 · Published 2026-09-27

Contrast is a tool that generates runtime security policies for confidential containers running on Kata Containers. The vulnerability allows an attacker with access to the Kata agent API (such as a Kubernetes cluster administrator) to substitute a container image with malicious code because the generated policies fail to verify image digests. This undermines the integrity guarantees of confidential containers and could lead to arbitrary code execution within the container environment.

Technologies: Edgeless Systems Contrast. Vendors: Edgeless Systems.

Quick answers

Is CVE-2026-100833 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100833 being exploited in the wild.
How severe is CVE-2026-100833?: High severity, with a CVSS score of 8.2, published 27 September 2026.
Which products and versions are affected?: Edgeless Systems Contrast 1.14.0 through 1.23.0.
Is there a fix for CVE-2026-100833?: A patch was published on 2026-09-27: Patches available in v1.23.1 and v1.24.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100833 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100833?: Check whether you run Edgeless Systems Contrast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from an incomplete rebase during a Kata Containers update that introduced an `allow_storage` rule accepting `image_guest_pull` driver entries without verifying image digests. An attacker with Kata agent API access can exploit this by substituting a container image with a payload that satisfies other policy rules. The flaw is in the runtime policy generation logic and affects versions 1.14.0 through 1.23.0; it was fixed in 1.23.1 by properly moving digest verification to the `allow_mount_point` rule.

Affected products

Edgeless Systems Contrast 1.14.0 through 1.23.0

Timeline

2026-08-24: disclosed: GitHub security advisory GHSA-m2qg-wrxv-h898 published
2026-09-27: other: NVD entry published as CVE-2026-100833
2026-09-27: patched: Patches available in v1.23.1 and v1.24.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.