GO-2026-5865 - Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain

Severity: info · Published 2026-07-07

Technologies: github.com/edgelesssys/contrast (Go). Vendors: Go.

Executive brief

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast

Affected products

Go github.com/edgelesssys/contrast

Related threats

GO-2026-5864 - Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts in github.com/edg
Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts
Edgeless Systems Contrast panic in transit engine UnmarshalJSON
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain
Edgeless Systems Contrast credential leak via unanchored suffix matching in Imagepuller