CVE-2025-71425: Contrast Information Disclosure Vulnerability

CVE-2025-71425 Overview

CVE-2025-71425 is an information disclosure vulnerability in Contrast by Edgeless Systems before version 1.8.1. The Contrast initializer logs the workload secret to stderr, and consequently to Kubernetes logs, when CONTRAST_LOG_LEVEL is set to info or debug. Because info is the default, every installation that does not customize the initializer log level is affected. The exposure grants access to workload secrets normally restricted to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner. The flaw is categorized under [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact
Kubernetes users with get or list permission on pods/logs, and anyone with read access to the cluster's log storage (including the cloud provider), can retrieve workload secrets used to protect confidential workloads.

Affected Products

Contrast (Edgeless Systems) versions prior to 1.8.1
Deployments using the Contrast initializer with default CONTRAST_LOG_LEVEL=info
Deployments using the Contrast initializer with CONTRAST_LOG_LEVEL=debug

Discovery Timeline

2026-09-27 - CVE-2025-71425 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2025-71425

Vulnerability Analysis

Contrast is Edgeless Systems' confidential-computing runtime for Kubernetes, built to isolate workloads inside hardware-backed trusted execution environments. Workload secrets are a core trust primitive: they are provisioned by the Contrast Coordinator and are intended to remain visible only to the Coordinator, the initializer, the seedshare owner, and the workload owner.

The initializer violates this trust boundary by writing the workload secret to stderr during normal operation. Container runtimes capture stderr and forward it to the Kubernetes logging pipeline, where it is persisted alongside standard pod output. Any identity with log read permissions in the cluster, or any backend storing those logs, inherits access to the secret.

Deployments that do not use workload secrets are not affected, since no secret material is generated for the initializer to log.

Root Cause

The root cause is sensitive data placed in a log stream at the default verbosity level [CWE-532]. The initializer treats the workload secret as diagnostic context suitable for info-level output, rather than as a confidentiality boundary that must never leave the enclave in cleartext.

Attack Vector

An attacker needs logical access to the Kubernetes control plane or the log backend. In practice, this includes service accounts with get/list on pods/logs, users bound to roles such as view, log aggregation pipelines (Fluent Bit, Loki, Elasticsearch, cloud-native logging), and the cloud provider operating the underlying log storage. The attack requires no code execution, no network exploit, and no interaction with the workload itself.

See the GitHub Security Advisory GHSA-h5f8-crrq-4pw8 and the VulnCheck Advisory on Information Disclosure for additional technical context.

Detection Methods for CVE-2025-71425

Indicators of Compromise

Initializer container log entries emitted at info or debug level that contain workload secret material.
kubectl logs output from Contrast initializer pods containing fields that resemble base64 or hex-encoded secret payloads.
Historical log index entries in cloud-native log stores (CloudWatch, Stackdriver, Azure Monitor) referencing Contrast initializer pods.

Detection Strategies

Audit all cluster RBAC bindings that grant get or list on pods/logs and verify which identities had access while running Contrast < 1.8.1.
Search historical Kubernetes log storage for initializer log lines generated before the upgrade to 1.8.1.
Review log forwarder configurations to identify every downstream system that received initializer stderr output.

Monitoring Recommendations

Enable Kubernetes API audit logging for pods/log subresource access and alert on unexpected principals.
Alert on reads to log storage buckets or indexes that archived Contrast initializer output prior to remediation.
Track container image versions in use and generate alerts when Contrast components below 1.8.1 are deployed.

How to Mitigate CVE-2025-71425

Immediate Actions Required

Upgrade Contrast to version 1.8.1 or later across all clusters that run confidential workloads.
Rotate every workload secret that was ever handled by a vulnerable initializer; treat prior secrets as compromised.
Purge or restrict access to Kubernetes logs and backend log stores that captured initializer output.
Review and tighten RBAC on pods/logs and on any log aggregation backend holding historical cluster logs.

Patch Information

Edgeless Systems resolved the issue in Contrast 1.8.1. Refer to the GitHub Security Advisory GHSA-h5f8-crrq-4pw8 for the authoritative fix notes and upgrade guidance.

Workarounds

If immediate upgrade is not possible, set CONTRAST_LOG_LEVEL to a level below info (for example, warn or error) on the initializer to suppress the sensitive log line.
Restrict get and list permissions on pods/logs to a minimal set of trusted principals until the upgrade is complete.
Reconfigure log forwarders to drop or redact initializer output destined for shared or cloud-provider-managed log storage.

bash

# Configuration example: suppress initializer verbose logging until upgrade
# Set the environment variable on the Contrast initializer container
env:
  - name: CONTRAST_LOG_LEVEL
    value: "warn"