Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...
zetlyn/cve-ghsa vulnerability ghsa GHSA-jw33-f4wc-8736 cve CVE-2026-100835 known 2026-09-27
https://github.com/advisories/GHSA-jw33-f4wc-8736
Properties
| cvss | 7.4receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
|---|---|
| cwe | CWE-295receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
| severity | critical GitHub's own rating, from the CVSS base score at 9.0 and above. receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
Text
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker who can both intercept network traffic between the CLI and the Coordinator (or between the Coordinator and an attested component) and forge reports or extract secrets from any single TEE machine under their physical control can relay such a report to impersonate a Contrast Coordinator or a Contrast workload, defeating identity verification in Contrast's attested TLS (aTLS).