{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-100837",
        "tracking": {
            "current_release_date": "2026-10-20T13:54:47.512679Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-100837",
            "initial_release_date": "2026-09-27T02:25:44.830538Z",
            "revision_history": [
                {
                    "date": "2026-09-27T02:25:44.830538Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-09-27T02:25:46.020950Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-09-27T12:10:58.209505Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (4).| CWES updated (1)."
                },
                {
                    "date": "2026-09-27T12:11:09.000969Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-09-27T15:15:09.855432Z",
                    "number": "5",
                    "summary": "EPSS created.| Unknown change."
                },
                {
                    "date": "2026-09-27T15:15:15.105091Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-09-27T18:13:07.031369Z",
                    "number": "7",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-09-27T18:13:08.306088Z",
                    "number": "8",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (3)."
                },
                {
                    "date": "2026-09-27T18:13:10.010773Z",
                    "number": "9",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-09-28T06:45:35.098655Z",
                    "number": "10",
                    "summary": "Products removed (1)."
                },
                {
                    "date": "2026-09-28T12:42:07.650784Z",
                    "number": "11",
                    "summary": "CVSS created.| CWES created (1).| Products created (1).| References created (2).| Description created for source.| Unknown change."
                },
                {
                    "date": "2026-09-28T12:42:11.436190Z",
                    "number": "12",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-09-28T14:38:39.110416Z",
                    "number": "13",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-09-29T16:13:19.698822Z",
                    "number": "14",
                    "summary": "EPSS created.| Unknown change."
                },
                {
                    "date": "2026-09-29T18:31:24.441087Z",
                    "number": "15",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-10-20T13:54:36.595369Z",
                    "number": "16",
                    "summary": "Products created (1)."
                }
            ],
            "status": "interim",
            "version": "16"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:semver/<=1.20.0",
                                "product": {
                                    "name": "vers:semver/<=1.20.0",
                                    "product_id": "CSAFPID-9478892"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<1.21.0",
                                "product": {
                                    "name": "vers:unknown/>=0|<1.21.0",
                                    "product_id": "CSAFPID-9475361"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/v1.20.0",
                                "product": {
                                    "name": "vers:unknown/v1.20.0",
                                    "product_id": "CSAFPID-9474607"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "contrast"
                    }
                ],
                "category": "vendor",
                "name": "edgelesssys"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-100837",
            "cwe": {
                "id": "CWE-1289",
                "name": "Improper Validation of Unsafe Equivalence in Input"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary, so a registry entry such as [registries.\"ghcr.io.\"] is also applied to any host whose name merely ends in that byte sequence, including attacker-registered domains such as evilghcr.io. When an image or layer is pulled from such a sibling domain, the imagepuller sends the configured Authorization header (basic auth, registry token, or identity token), trusts the configured custom CA bundle, follows the configured mirror, and honours insecure-skip-verify (disabling TLS verification) for that host. Image integrity is not affected, as image bytes remain pinned by digest in the policy and are validated after the pull. Configurations that use a leading dot (e.g., [registries.\".example.registry\"]) are unaffected.",
                    "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100837"
                },
                {
                    "category": "description",
                    "text": "Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary, so a registry entry such as [registries.\"ghcr.io.\"] is also applied to any host whose name merely ends in that byte sequence, including attacker-registered domains such as evilghcr.io. When an image or layer is pulled from such a sibling domain, the imagepuller sends the configured Authorization header (basic auth, registry token, or identity token), trusts the configured custom CA bundle, follows the configured mirror, and honours insecure-skip-verify (disabling TLS verification) for that host. Image integrity is not affected, as image bytes remain pinned by digest in the policy and are validated after the pull. Configurations that use a leading dot (e.g., [registries.\".example.registry\"]) are unaffected.",
                    "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100837.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "# Summary\n\n`Config.registryFor` selected a per-registry credential / CA / mirror block by checking `strings.HasSuffix(name, fqdn)` after stripping a single trailing dot. \nThe match has no boundary between the configured FQDN and any preceding characters in the request hostname.\nA registry configured as `[registries.\"ghcr.io.\"]` is therefore also applied to any image pulled from a host whose name happens to end in the literal byte sequence `ghcr.io`, \nincluding attacker-registered domains such as `evilghcr.io.` \nThe imagepuller would then send the configured `Authorization` header (basic auth, registry token, or identity token), trust the configured custom CA bundle,\nfollow the configured mirror, or honour `insecure-skip-verify`, on requests to that hostname.\n\n# Prerequisites\n\nFor this to be applicable, an image or layer must be pulled from a \"sibling\" domain ending in one of the FQDNs configured in the imagepuller config.\nThis may occur due to malicious intent or coincidentally.\n\n# Impact\n\n- Authentication header leaks to the sibling registry.\n- If `insecure-skip-verify` is set on an FQDN, TLS will also not be verified for the sibling registry.\n- Mirrors configured for an FQDN will also be used with the sibling registry.\n\n## Not impacted\n\nImage integrity is **not** impacted. Image bytes remain pinned by digest in the policy and are validated after the pull.\nThis advisory does not allow code substitution.\n\n# Workaround\n\n- If possible, configure explicit subdomains in the imagepuller config. A configuration for `[registries.\".example.registry\"]` is unaffected, only `[registries.\"example.registry\"]` is potentially affected.\n- Audit images and layers configured in the deployment for the existence of sibling domains.\n\n# Patches\n\nAfter this patch, registry matches are determined by exact label equality instead of suffix matching.\nEach `.`-separated part of the FQDN must be an exact match with the corresponding label in the image reference.\n\n# Severity\n\n- `AV:N` because the leak is over the network to a registry under the attacker's control. \n- `AC:H` because exploitation requires the operator to have configured a registry FQDN without a leading `.` AND the attacker to control a sibling-suffix domain that the deployment will pull from.\n- `PR:N` for the eventual recipient. \n- `S:U` because impact stays in the imagepuller. \n- `C:L` for credential leak (no integrity / availability impact).",
                    "title": "osvgo - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-6c87-g9pw-78fx.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast",
                    "title": "osvgo - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-5865.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary, so a registry entry such as [registries.\"ghcr.io.\"] is also applied to any host whose name merely ends in that byte sequence, including attacker-registered domains such as evilghcr.io. When an image or layer is pulled from such a sibling domain, the imagepuller sends the configured Authorization header (basic auth, registry token, or identity token), trusts the configured custom CA bundle, follows the configured mirror, and honours insecure-skip-verify (disabling TLS verification) for that host. Image integrity is not affected, as image bytes remain pinned by digest in the policy and are validated after the pull. Configurations that use a leading dot (e.g., [registries.\".example.registry\"]) are unaffected.",
                    "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100837"
                },
                {
                    "category": "description",
                    "text": "Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-5865.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "# Summary\n\n`Config.registryFor` selected a per-registry credential / CA / mirror block by checking `strings.HasSuffix(name, fqdn)` after stripping a single trailing dot. \nThe match has no boundary between the configured FQDN and any preceding characters in the request hostname.\nA registry configured as `[registries.\"ghcr.io.\"]` is therefore also applied to any image pulled from a host whose name happens to end in the literal byte sequence `ghcr.io`, \nincluding attacker-registered domains such as `evilghcr.io.` \nThe imagepuller would then send the configured `Authorization` header (basic auth, registry token, or identity token), trust the configured custom CA bundle,\nfollow the configured mirror, or honour `insecure-skip-verify`, on requests to that hostname.\n\n# Prerequisites\n\nFor this to be applicable, an image or layer must be pulled from a \"sibling\" domain ending in one of the FQDNs configured in the imagepuller config.\nThis may occur due to malicious intent or coincidentally.\n\n# Impact\n\n- Authentication header leaks to the sibling registry.\n- If `insecure-skip-verify` is set on an FQDN, TLS will also not be verified for the sibling registry.\n- Mirrors configured for an FQDN will also be used with the sibling registry.\n\n## Not impacted\n\nImage integrity is **not** impacted. Image bytes remain pinned by digest in the policy and are validated after the pull.\nThis advisory does not allow code substitution.\n\n# Workaround\n\n- If possible, configure explicit subdomains in the imagepuller config. A configuration for `[registries.\".example.registry\"]` is unaffected, only `[registries.\"example.registry\"]` is potentially affected.\n- Audit images and layers configured in the deployment for the existence of sibling domains.\n\n# Patches\n\nAfter this patch, registry matches are determined by exact label equality instead of suffix matching.\nEach `.`-separated part of the FQDN must be an exact match with the corresponding label in the image reference.\n\n# Severity\n\n- `AV:N` because the leak is over the network to a registry under the attacker's control. \n- `AC:H` because exploitation requires the operator to have configured a registry FQDN without a leading `.` AND the attacker to control a sibling-suffix domain that the deployment will pull from.\n- `PR:N` for the eventual recipient. \n- `S:U` because impact stays in the imagepuller. \n- `C:L` for credential leak (no integrity / availability impact).",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-6c87-g9pw-78fx.json?alt=media"
                },
                {
                    "category": "other",
                    "text": "0.00213",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                    "title": "CVSSV4"
                },
                {
                    "category": "other",
                    "text": "6.3",
                    "title": "CVSSV4 base score"
                },
                {
                    "category": "other",
                    "text": "4.2",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "There is cwe data available from source Nvd, The value of the most recent CVSS (V3) score",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-9475361",
                    "CSAFPID-9478892",
                    "CSAFPID-9474607"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100837.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-5865.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-6c87-g9pw-78fx.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100837"
                },
                {
                    "category": "external",
                    "summary": "Source - ncscclear",
                    "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100837"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-100837"
                },
                {
                    "category": "external",
                    "summary": "Source - osvgo",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-6c87-g9pw-78fx.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - osvgo",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-5865.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; nvd; osv; osvgo",
                    "url": "https://github.com/edgelesssys/contrast/security/advisories/GHSA-6c87-g9pw-78fx"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; nvd; osv",
                    "url": "https://www.vulncheck.com/advisories/edgeless-systems-contrast-through-1.20.0-credential-leak-via-registry-suffix-matching"
                },
                {
                    "category": "external",
                    "summary": "Reference - osv; osvgo",
                    "url": "https://github.com/edgelesssys/contrast/commit/10826b1d82613025767fb094e8aa51a7dcfbd2a1"
                },
                {
                    "category": "external",
                    "summary": "Reference - osv; osvgo",
                    "url": "https://github.com/edgelesssys/contrast/releases/tag/v1.21.0"
                },
                {
                    "category": "external",
                    "summary": "Reference - osv",
                    "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100837.json"
                },
                {
                    "category": "external",
                    "summary": "Reference - osv",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100837"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                        "baseScore": 3.7,
                        "baseSeverity": "LOW"
                    },
                    "products": [
                        "CSAFPID-9474607",
                        "CSAFPID-9475361",
                        "CSAFPID-9478892"
                    ]
                }
            ],
            "title": "CVE-2026-100837"
        }
    ]
}