Information Disclosure via Workload Secret Logging in Edgelesssys Contrast

Edgelesssys Contrast, a confidential-computing runtime for Kubernetes, contains an information disclosure vulnerability in versions 1.9.0 prior to 1.12.2. The initializer component performs insecure logging of the full NewMeshCert response at the INFO level to standard output. This output contains critical workload secrets used for encrypted storage and Vault integration.

Any Kubernetes user or service account with 'get' or 'list' permissions on pod logs can extract these secrets directly from the container logs. Because these secrets protect encrypted storage and integration channels, their exposure constitutes a full compromise of the affected workload's security boundaries. This vulnerability is a regression of a previously addressed flaw (GHSA-h5f8-crrq-4pw8). Defenders must verify their Contrast deployment versions and restrict access to Kubernetes pod logs as an immediate mitigation.

Impact

The vulnerability allows for the unauthorized retrieval of workload secrets, leading to a complete compromise of confidential computing environments. Attackers can leverage these exposed secrets to decrypt stored data or impersonate workloads in integrated systems like HashiCorp Vault. This flaw exposes sensitive organizational data across all Kubernetes clusters running affected versions of Contrast.

Recommendation

• Upgrade Edgelesssys Contrast to version 1.12.2 or later to eliminate the insecure logging behavior.
• Audit Kubernetes Role-Based Access Control (RBAC) to identify and limit users and service accounts with broad 'get' or 'list' access to pod logs.
• Rotate any secrets that have been accessible via pod logs in clusters where versions 1.9.0 through 1.12.1 were deployed.
• Monitor Kubernetes audit logs for suspicious 'get' or 'list' requests targeting pod logs, specifically looking for users attempting to access logs of the Contrast initializer component.