# CVE-2026-100835: Edgeless Systems Contrast remote attestation relay attack

Source: https://junglewise.ai/threats/cve-2026-100835-contrast-before-1-16-0-is-susceptible-to-remote-attestation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100835 · Severity: high · CVSS 7.4 · Published 2026-09-27

Contrast is a confidential computing orchestration platform that uses trusted hardware to protect sensitive workloads. Before version 1.16.0, the system accepted attestation reports from any machine with the correct measurements, allowing an attacker with network access and physical control of a single TEE device to relay forged attestation reports and impersonate authorized Coordinators or workloads, compromising identity verification in the attested TLS layer.

Technologies: [Edgeless Systems Contrast](https://junglewise.ai/threats/technologies/contrast). Vendors: [Edgeless Systems](https://junglewise.ai/threats/vendors/edgeless-systems).

## Quick answers

**Is CVE-2026-100835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100835 being exploited in the wild.

**How severe is CVE-2026-100835?** High severity, with a CVSS score of 7.4, published 27 September 2026.

**Which products and versions are affected?** Edgeless Systems Contrast before 1.16.0.

**Is there a fix for CVE-2026-100835?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100835 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100835?** Check whether you run Edgeless Systems Contrast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability arises from attestation reports not being bound to specific hardware instances; Contrast verified TEE attestation evidence based on correctness and expected firmware/measurements without validating the physical identity of the originating machine. An attacker must intercept network traffic between the CLI and Coordinator or between Coordinator and attested component, and can exploit physical attacks on a single TEE to extract secrets or forge reports. The fix in v1.16.0 introduces optional manifest fields (AllowedChipIDs for SEV-SNP, AllowedPIIDs for TDX) to restrict validation to trusted hardware with known physical protection.

## Affected products

- Edgeless Systems Contrast before 1.16.0

## Timeline

- 2026-09-27: disclosed

## References

- [https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h](https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h)
- [https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack](https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack)

## Related threats

- [Contrast improper verification in Coordinator peer recovery](https://junglewise.ai/threats/cve-2026-109359-contrast-1-8-0-before-1-24-1-contains-an-improper-verification)
- [Edgeless Systems Contrast privilege escalation in node installer](https://junglewise.ai/threats/cve-2026-109358-edgeless-systems-contrast-1-8-0-before-1-24-1-contains-an)
- [Edgeless Systems Contrast AML injection in ACPI handler](https://junglewise.ai/threats/cve-2026-100839-contrast-is-a-confidential-computing-runtime-for-kubernetes-in)
- [Edgeless Systems Contrast arbitrary filesystem write in CopyFile policy](https://junglewise.ai/threats/cve-2026-100838-contrast-is-a-confidential-computing-runtime-for-kubernetes-in)
- [Edgeless Systems Contrast panic in ciphertextContainer.UnmarshalJSON](https://junglewise.ai/threats/cve-2026-100836-contrast-through-1-20-0-contains-a-panic-vulnerability-in-the)