CVE-2026-109359
Description
A flaw was found in Contrast. The Coordinator peer recovery process fails to verify that a serving peer uses the current manifest generation. An attacker with write access to the manifest history can exploit this flaw by replaying superseded history records. This action can lead to sensitive information disclosure of the mesh Certificate Authority (CA) key or allow retired workloads to obtain trusted mesh certificates.
Statement
This vulnerability is rated as Important severity because a successful exploit can compromise the cryptographic root of trust for the mesh domain, potentially exposing the mesh CA private key and allowing revoked workloads to acquire valid identity certificates. The severity reflects this critical scope compromise, though exploitation is constrained by requiring elevated administrative privileges to tamper with manifest history during peer synchronization. Contrast is not shipped or supported in Red Hat Enterprise Linux or OpenShift, so standard Red Hat environments are not affected.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
