Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...

zetlyn/cve-ghsa vulnerability ghsa GHSA-jw33-f4wc-8736 cve CVE-2026-100835 known 2026-09-27

https://github.com/advisories/GHSA-jw33-f4wc-8736

Properties

cvss

cvss	7.4 receipt Source GitHub advisories Its words `7.4` Read by `field:cvss.score` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100835", "cvss": { "score": 7.4, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "cvss_severities": { "cvss_v3": { "score": 7.4, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "cvss_v4": { "score": 9.1, "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-295", "name": "Improper Certificate Validation" } ], "description": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).", "epss": { "percentage": 0.00217, "percentile": 0.10897 }, "ghsa_id": "GHSA-jw33-f4wc-8736", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-jw33-f4wc-8736", "identifiers": [ { "type": "GHSA", "value": "GHSA-jw33-f4wc-8736" }, { "type": "CVE", "value": "CVE-2026-100835" } ], "nvd_published_at": "2026-09-27T02:17:21Z", "published_at": "2026-09-27T03:31:04Z", "references": [ "https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h", "https://nvd.nist.gov/vuln/detail/CVE-2026-100835", "https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack", "https://github.com/advisories/GHSA-jw33-f4wc-8736" ], "repository_advisory_url": null, "severity": "critical", "source_code_location": "", "summary": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...", "type": "unreviewed", "updated_at": "2026-09-27T03:31:12Z", "url": "https://api.github.com/advisories/GHSA-jw33-f4wc-8736", "vulnerabilities": [], "withdrawn_at": null }
cwe	CWE-295 receipt Source GitHub advisories Its words `CWE-295` Read by `field:cwes[].cwe_id` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100835", "cvss": { "score": 7.4, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "cvss_severities": { "cvss_v3": { "score": 7.4, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "cvss_v4": { "score": 9.1, "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-295", "name": "Improper Certificate Validation" } ], "description": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).", "epss": { "percentage": 0.00217, "percentile": 0.10897 }, "ghsa_id": "GHSA-jw33-f4wc-8736", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-jw33-f4wc-8736", "identifiers": [ { "type": "GHSA", "value": "GHSA-jw33-f4wc-8736" }, { "type": "CVE", "value": "CVE-2026-100835" } ], "nvd_published_at": "2026-09-27T02:17:21Z", "published_at": "2026-09-27T03:31:04Z", "references": [ "https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h", "https://nvd.nist.gov/vuln/detail/CVE-2026-100835", "https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack", "https://github.com/advisories/GHSA-jw33-f4wc-8736" ], "repository_advisory_url": null, "severity": "critical", "source_code_location": "", "summary": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...", "type": "unreviewed", "updated_at": "2026-09-27T03:31:12Z", "url": "https://api.github.com/advisories/GHSA-jw33-f4wc-8736", "vulnerabilities": [], "withdrawn_at": null }
severity	critical GitHub's own rating, from the CVSS base score at 9.0 and above. receipt Source GitHub advisories Its words `critical` Read by `field:severity` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100835", "cvss": { "score": 7.4, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "cvss_severities": { "cvss_v3": { "score": 7.4, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "cvss_v4": { "score": 9.1, "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-295", "name": "Improper Certificate Validation" } ], "description": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).", "epss": { "percentage": 0.00217, "percentile": 0.10897 }, "ghsa_id": "GHSA-jw33-f4wc-8736", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-jw33-f4wc-8736", "identifiers": [ { "type": "GHSA", "value": "GHSA-jw33-f4wc-8736" }, { "type": "CVE", "value": "CVE-2026-100835" } ], "nvd_published_at": "2026-09-27T02:17:21Z", "published_at": "2026-09-27T03:31:04Z", "references": [ "https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h", "https://nvd.nist.gov/vuln/detail/CVE-2026-100835", "https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack", "https://github.com/advisories/GHSA-jw33-f4wc-8736" ], "repository_advisory_url": null, "severity": "critical", "source_code_location": "", "summary": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...", "type": "unreviewed", "updated_at": "2026-09-27T03:31:12Z", "url": "https://api.github.com/advisories/GHSA-jw33-f4wc-8736", "vulnerabilities": [], "withdrawn_at": null }

7.4

receipt

Source: GitHub advisories
Its words: 7.4
Read by: field:cvss.score
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100835",
  "cvss": {
    "score": 7.4,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.4,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
    },
    "cvss_v4": {
      "score": 9.1,
      "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-295",
      "name": "Improper Certificate Validation"
    }
  ],
  "description": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).",
  "epss": {
    "percentage": 0.00217,
    "percentile": 0.10897
  },
  "ghsa_id": "GHSA-jw33-f4wc-8736",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jw33-f4wc-8736",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jw33-f4wc-8736"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100835"
    }
  ],
  "nvd_published_at": "2026-09-27T02:17:21Z",
  "published_at": "2026-09-27T03:31:04Z",
  "references": [
    "https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100835",
    "https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack",
    "https://github.com/advisories/GHSA-jw33-f4wc-8736"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...",
  "type": "unreviewed",
  "updated_at": "2026-09-27T03:31:12Z",
  "url": "https://api.github.com/advisories/GHSA-jw33-f4wc-8736",
  "vulnerabilities": [],
  "withdrawn_at": null
}

cwe

CWE-295

receipt

Source: GitHub advisories
Its words: CWE-295
Read by: field:cwes[].cwe_id
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100835",
  "cvss": {
    "score": 7.4,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.4,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
    },
    "cvss_v4": {
      "score": 9.1,
      "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-295",
      "name": "Improper Certificate Validation"
    }
  ],
  "description": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).",
  "epss": {
    "percentage": 0.00217,
    "percentile": 0.10897
  },
  "ghsa_id": "GHSA-jw33-f4wc-8736",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jw33-f4wc-8736",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jw33-f4wc-8736"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100835"
    }
  ],
  "nvd_published_at": "2026-09-27T02:17:21Z",
  "published_at": "2026-09-27T03:31:04Z",
  "references": [
    "https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100835",
    "https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack",
    "https://github.com/advisories/GHSA-jw33-f4wc-8736"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...",
  "type": "unreviewed",
  "updated_at": "2026-09-27T03:31:12Z",
  "url": "https://api.github.com/advisories/GHSA-jw33-f4wc-8736",
  "vulnerabilities": [],
  "withdrawn_at": null
}

severity

critical

GitHub's own rating, from the CVSS base score at 9.0 and above.

receipt

Source: GitHub advisories
Its words: critical
Read by: field:severity
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100835",
  "cvss": {
    "score": 7.4,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.4,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
    },
    "cvss_v4": {
      "score": 9.1,
      "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-295",
      "name": "Improper Certificate Validation"
    }
  ],
  "description": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).",
  "epss": {
    "percentage": 0.00217,
    "percentile": 0.10897
  },
  "ghsa_id": "GHSA-jw33-f4wc-8736",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jw33-f4wc-8736",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jw33-f4wc-8736"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100835"
    }
  ],
  "nvd_published_at": "2026-09-27T02:17:21Z",
  "published_at": "2026-09-27T03:31:04Z",
  "references": [
    "https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100835",
    "https://www.vulncheck.com/advisories/contrast-before-1.16.0-remote-attestation-relay-attack",
    "https://github.com/advisories/GHSA-jw33-f4wc-8736"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...",
  "type": "unreviewed",
  "updated_at": "2026-09-27T03:31:12Z",
  "url": "https://api.github.com/advisories/GHSA-jw33-f4wc-8736",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any... Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).