CVE-2025-71425
Contrast before 1.8.1 Information Disclosure via Logging
Description
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.
INFO
Published Date :
Sept. 27, 2026, 2:17 a.m.
Last Modified :
Oct. 14, 2026, 1:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-71425
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update the Contrast initializer to version 1.8.1.
- Configure CONTRAST_LOG_LEVEL to a level other than info or debug.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-71425.
| URL | Resource |
|---|---|
| https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8 | |
| https://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-71425 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-71425
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-71425 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-71425 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 14, 2026
Action Type Old Value New Value Added Translation Title: Contrast de edgelesssys, Description: Contrast (Edgeless Systems) anterior a 1.8.1 registra el secreto de la carga de trabajo en stderr y, por lo tanto, en los registros de Kubernetes, cuando el inicializador de Contrast está configurado con CONTRAST_LOG_LEVEL establecido en 'info' o 'debug'. Dado que 'info' es el valor predeterminado, todas las instalaciones que no personalizan el nivel de registro del inicializador se ven afectadas. Esto expone los secretos de la carga de trabajo -normalmente accesibles solo para el Coordinador de Contrast, el inicializador, el propietario de seedshare y el propietario de la carga de trabajo- a los usuarios de Kubernetes con permiso de 'get' o 'list' en 'pods/logs' y a cualquier persona con acceso de lectura al almacenamiento de registros de Kubernetes, como el proveedor de la nube. Las implementaciones que no utilizan secretos de carga de trabajo no se ven afectadas. -
CVE Modified by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/71xxx/CVE-2025-71425.json">CVE-2025-71425</a> -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 30, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-71425', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-09-30T17:24:53.076609Z'} -
New CVE Received by [email protected]
Sep. 27, 2026
Action Type Old Value New Value Added Description Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected. Added CVSS V4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Added CWE CWE-532 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/71xxx/CVE-2025-71425.json">CVE-2025-71425</a> Added Reference https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8 Added Reference https://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging