# github.com/edgelesssys/contrast (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-edgelesssys-contrast Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-edgelesssys-contrast.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in github.com/edgelesssys/contrast (Go): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, GO-2026-5865 - Contrast's Imagepuller registryFor uses unanchored suffix…, was published on 7 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 18 (0 critical, 0 exploited in the wild) ## About github.com/edgelesssys/contrast (Go) A confidential computing tool for deploying and managing encrypted Kubernetes clusters. ## Latest github.com/edgelesssys/contrast (Go) vulnerabilities - [GO-2026-5865 - Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and…](https://junglewise.ai/threats/go-2026-5865-contrast-s-imagepuller-registryfor-uses-unanchored-suffix-d277ae67) (info, published 7 Jul 2026) - [GO-2026-5864 - Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on…](https://junglewise.ai/threats/go-2026-5864-constrata-s-coordinator-transit-engine-ciphertextcontainer-c5be25a1) (info, published 7 Jul 2026) - [Edgeless Systems Contrast panic in transit engine UnmarshalJSON](https://junglewise.ai/threats/edgeless-systems-contrast-panic-in-transit-engine-unmarshaljson-f1fe367f) (medium, CVSS 4.3, published 1 Jul 2026) - [Edgeless Systems Contrast credential leak via unanchored suffix matching in Imagepuller](https://junglewise.ai/threats/edgeless-systems-contrast-credential-leak-via-unanchored-suffix-9d4532bc) (low, CVSS 3.7, published 1 Jul 2026) - [GO-2026-5624 - Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast](https://junglewise.ai/threats/go-2026-5624-contras-affected-by-copyfile-policy-subversion-via-12460907) (info, published 25 Jun 2026) - [Contras Affected by CopyFile Policy Subversion via Symlinks](https://junglewise.ai/threats/contras-affected-by-copyfile-policy-subversion-via-symlinks-0d6ca43d) (low, CVSS 3.1, published 30 Apr 2026) - [GO-2026-4863 - Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast](https://junglewise.ai/threats/go-2026-4863-contrast-badaml-injection-allows-arbitrary-code-execution-79066b49) (info, published 2 Apr 2026) - [Contrast BadAML injection allows arbitrary code execution](https://junglewise.ai/threats/contrast-badaml-injection-allows-arbitrary-code-execution-bb9129e6) (low, CVSS 3.1, published 26 Mar 2026) - [GO-2025-4078 - Contrast has insecure LUKS2 persistent storage partitions may be opened and used in…](https://junglewise.ai/threats/go-2025-4078-contrast-has-insecure-luks2-persistent-storage-partitions-98e214f7) (info, published 5 Nov 2025) - [Contrast has insecure LUKS2 persistent storage partitions may be opened and used](https://junglewise.ai/threats/contrast-has-insecure-luks2-persistent-storage-partitions-may-be-opened-5c0eb66a) (low, CVSS 3.1, published 28 Oct 2025) - [GO-2025-3920 - Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast](https://junglewise.ai/threats/go-2025-3920-contrast-leaks-workload-secrets-to-logs-on-info-level-in-a30a42e0) (info, published 8 Sep 2025) - [Contrast leaks workload secrets to logs on INFO level](https://junglewise.ai/threats/contrast-leaks-workload-secrets-to-logs-on-info-level-7a4229e4) (low, CVSS 3.1, published 28 Aug 2025) - [GO-2025-3807 - Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points in…](https://junglewise.ai/threats/go-2025-3807-contrast-vulnerability-allows-arbitrary-host-data-c06f6e07) (info, published 28 Jul 2025) - [Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points](https://junglewise.ai/threats/contrast-vulnerability-allows-arbitrary-host-data-injection-into-51171df5) (low, CVSS 3.1, published 9 Jul 2025) - [GO-2025-3718 - Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast](https://junglewise.ai/threats/go-2025-3718-contrast-workload-secrets-leak-to-logs-on-info-level-in-0c5c92b0) (info, published 29 May 2025) - [Contrast workload secrets leak to logs on INFO level](https://junglewise.ai/threats/contrast-workload-secrets-leak-to-logs-on-info-level-ef0d231a) (low, CVSS 3.1, published 28 May 2025) - [GO-2025-3455 - Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast](https://junglewise.ai/threats/go-2025-3455-contrast-s-unauthenticated-recovery-allows-coordinator-03aa6e94) (info, published 5 Feb 2025) - [Contrast's unauthenticated recovery allows Coordinator impersonation](https://junglewise.ai/threats/contrast-s-unauthenticated-recovery-allows-coordinator-impersonation-38d15ce0) (low, CVSS 3.1, published 5 Feb 2025) ## Most severe github.com/edgelesssys/contrast (Go) vulnerabilities - [Edgeless Systems Contrast panic in transit engine UnmarshalJSON](https://junglewise.ai/threats/edgeless-systems-contrast-panic-in-transit-engine-unmarshaljson-f1fe367f) (medium, CVSS 4.3, published 1 Jul 2026) - [Edgeless Systems Contrast credential leak via unanchored suffix matching in Imagepuller](https://junglewise.ai/threats/edgeless-systems-contrast-credential-leak-via-unanchored-suffix-9d4532bc) (low, CVSS 3.7, published 1 Jul 2026) - [Contras Affected by CopyFile Policy Subversion via Symlinks](https://junglewise.ai/threats/contras-affected-by-copyfile-policy-subversion-via-symlinks-0d6ca43d) (low, CVSS 3.1, published 30 Apr 2026) - [Contrast BadAML injection allows arbitrary code execution](https://junglewise.ai/threats/contrast-badaml-injection-allows-arbitrary-code-execution-bb9129e6) (low, CVSS 3.1, published 26 Mar 2026) - [Contrast has insecure LUKS2 persistent storage partitions may be opened and used](https://junglewise.ai/threats/contrast-has-insecure-luks2-persistent-storage-partitions-may-be-opened-5c0eb66a) (low, CVSS 3.1, published 28 Oct 2025) - [Contrast leaks workload secrets to logs on INFO level](https://junglewise.ai/threats/contrast-leaks-workload-secrets-to-logs-on-info-level-7a4229e4) (low, CVSS 3.1, published 28 Aug 2025) - [Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points](https://junglewise.ai/threats/contrast-vulnerability-allows-arbitrary-host-data-injection-into-51171df5) (low, CVSS 3.1, published 9 Jul 2025) - [Contrast workload secrets leak to logs on INFO level](https://junglewise.ai/threats/contrast-workload-secrets-leak-to-logs-on-info-level-ef0d231a) (low, CVSS 3.1, published 28 May 2025) - [Contrast's unauthenticated recovery allows Coordinator impersonation](https://junglewise.ai/threats/contrast-s-unauthenticated-recovery-allows-coordinator-impersonation-38d15ce0) (low, CVSS 3.1, published 5 Feb 2025) - [GO-2026-5864 - Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on…](https://junglewise.ai/threats/go-2026-5864-constrata-s-coordinator-transit-engine-ciphertextcontainer-c5be25a1) (info, published 7 Jul 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/edgelesssys/contrast (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-edgelesssys-contrast, 13 November 2026.