{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/contrast-1.8.0-1.24.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:contrast:contrast:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-109359"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contrast (1.8.0-1.24.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Contrast"],"content_html":"\u003cp\u003eContrast versions 1.8.0 through 1.24.0 are affected by an improper verification vulnerability (CVE-2026-109359) within the Coordinator peer recovery mechanism. The flaw stems from a failure to confirm that a serving peer utilizes the same manifest generation during the recovery handshake. An attacker who gains write access to the manifest history can perform a replay attack using a superseded history head. This enables the issuance of trusted mesh certificates to unauthorized, withdrawn workloads or, in scenarios where the secret seed is obtained, the disclosure of the Mesh CA key. This vulnerability poses a significant risk to the integrity of the service mesh environment, potentially allowing for lateral movement or intercept of encrypted traffic by unauthorized workloads.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the compromise of service mesh authentication and authorization, permitting unauthorized workloads to masquerade as trusted entities. If the Mesh CA key is disclosed via the secret seed, an attacker could potentially sign arbitrary certificates, leading to a complete compromise of the mesh trust domain. This affects organizations deploying Contrast versions prior to 1.24.1.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Contrast to version 1.24.1 or later to resolve the improper verification flaw in peer recovery.\u003c/li\u003e\n\u003cli\u003eAudit access controls for the manifest history storage to prevent unauthorized write modifications that could facilitate replay attacks.\u003c/li\u003e\n\u003cli\u003eRotate the Mesh CA key and associated secret seeds immediately if there is any indication that the environment was exposed or if the integrity of the manifest history is in question.\u003c/li\u003e\n\u003cli\u003eReview network logs and service mesh orchestration logs for anomalous peer recovery attempts or synchronization requests originating from unauthorized or withdrawn workloads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T20:30:15Z","date_published":"2026-10-12T20:30:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-contrast-coordinator-flaw/","summary":"Contrast versions 1.8.0 through 1.24.0 are vulnerable to an improper verification flaw in the Coordinator peer recovery process that allows manifest history replay and potential Mesh CA key disclosure.","title":"Improper Verification Vulnerability in Contrast Coordinator Peer Recovery","url":"https://feed.craftedsignal.io/briefs/2026-10-contrast-coordinator-flaw/"}],"language":"en","title":"CraftedSignal Threat Feed - Contrast (1.8.0-1.24.0)","version":"https://jsonfeed.org/version/1.1"}