Any Kubernetes user or service account with 'get' or 'list' permissions on pod logs can extract these secrets directly from the container logs. Because these secrets protect encrypted storage and integration channels, their exposure constitutes a full compromise of the affected workload's security boundaries. This vulnerability is a regression of a previously addressed flaw (GHSA-h5f8-crrq-4pw8). Defenders must verify their Contrast deployment versions and restrict access to Kubernetes pod logs as an immediate mitigation.

Impact

The vulnerability allows for the unauthorized retrieval of workload secrets, leading to a complete compromise of confidential computing environments. Attackers can leverage these exposed secrets to decrypt stored data or impersonate workloads in integrated systems like HashiCorp Vault. This flaw exposes sensitive organizational data across all Kubernetes clusters running affected versions of Contrast.

Recommendation

• Upgrade Edgelesssys Contrast to version 1.12.2 or later to eliminate the insecure logging behavior.
• Audit Kubernetes Role-Based Access Control (RBAC) to identify and limit users and service accounts with broad 'get' or 'list' access to pod logs.
• Rotate any secrets that have been accessible via pod logs in clusters where versions 1.9.0 through 1.12.1 were deployed.
• Monitor Kubernetes audit logs for suspicious 'get' or 'list' requests targeting pod logs, specifically looking for users attempting to access logs of the Contrast initializer component.