Improper Seed Verification in Contrast Kubernetes Confidential-Computing Runtime

Contrast, a confidential-computing runtime for Kubernetes, contains a vulnerability (CVE-2025-71426) in versions prior to 1.4.1. The flaw resides in the recovery process of the Coordinator, which fails to verify the cryptographic seed provided by a recovering party. This oversight allows an attacker to deploy a rogue Coordinator that satisfies initial manifest validation requirements but utilizes an attacker-controlled secret seed. If the attacker succeeds in redirecting network traffic from the legitimate Coordinator to their rogue instance, they can successfully impersonate the Coordinator. This is particularly effective if the workload owner fails to manually verify the root CA certificate against a trusted reference, which is common given the default behavior of the contrast CLI. Once the rogue Coordinator is trusted, the attacker can issue certificates that chain to their own CA, enabling the recovery of secrets for any workloads deployed after the traffic redirection.

Impact

The vulnerability poses a high risk to Kubernetes workloads using Contrast for confidential computing. If exploited, an attacker can access sensitive workload secrets. While the legitimate Coordinator's internal secrets (such as its own seed and CA) remain secure, the exposure of workload-specific secrets impacts the confidentiality of data-in-use for services deployed within the compromised mesh.

Recommendation

• Upgrade the Contrast Kubernetes runtime to version 1.4.1 or later to remediate CVE-2025-71426.
• Audit Kubernetes network policies to restrict unauthorized traffic redirection to sensitive control plane components.
• Mandate strict verification of root CA certificates for all Coordinator communication, ensuring they are compared against known-good trusted references rather than relying on default CLI behavior.