SECURITYHIGHCVE-2025-71425

Contrast Initializer Leaks Workload Secret to stderr (CVE-2025-71425)

Edgeless Systems Contrast before 1.8.1 logs the workload secret to stderr at the default log level, exposing it via Kubernetes logs.

Dylan H.

Security Team

September 27, 2026
3 min read
Contrast Initializer Leaks Workload Secret to stderr (CVE-2025-71425)

Affected Products

  • Contrast (Edgeless Systems) before 1.8.1

Executive Summary

A high-severity information disclosure vulnerability (CVE-2025-71425) has been disclosed in Contrast, Edgeless Systems' confidential-computing runtime for Kubernetes. In versions before 1.8.1, the Contrast initializer logs the workload secret to stderr — and therefore into Kubernetes-collected logs — whenever CONTRAST_LOG_LEVEL is set to info or debug. Because info is the default log level, every installation that has not explicitly customized the initializer's log level is affected out of the box.

This is the original issue later reintroduced as a regression tracked separately as CVE-2025-71423.

CVSS Score: 7.3 (High) Fixed in: Contrast 1.8.1

Vulnerability Overview

AttributeValue
CVE IDCVE-2025-71425
CVSS Score7.3 (High)
TypeSensitive Information Disclosure via Logging (CWE-532)
ComponentContrast initializer
Affected VersionsBefore 1.8.1
Fixed Version1.8.1
Default-AffectedYes — info is the default CONTRAST_LOG_LEVEL
Later Reintroduced AsCVE-2025-71423 (regression)

Technical Details

Root Cause

The Contrast initializer writes diagnostic output to stderr, which Kubernetes captures as part of standard pod logs. When CONTRAST_LOG_LEVEL is set to info (the default) or debug, that diagnostic output includes the workload secret — a value that Contrast's design intends to keep accessible only to the Coordinator, the initializer, the seedshare owner, and the workload owner.

Because info requires no explicit configuration to trigger the exposure, every default Contrast deployment predating 1.8.1 was affected without any misconfiguration on the operator's part.

Attack Chain

1. A Contrast-protected workload is deployed with default settings
   (CONTRAST_LOG_LEVEL unset, defaulting to "info")
 
2. The initializer logs the workload secret to stderr during startup
 
3. Kubernetes captures container stderr as pod logs
 
4. Any principal with get/list on pods/logs — or read access to
   wherever cluster logs are shipped — retrieves the workload secret
 
5. The attacker uses the recovered secret to compromise encrypted
   storage or impersonate the workload against Vault

Impact Assessment

Impact AreaDescription
ConfidentialityWorkload secrets, and everything they protect, must be treated as compromised for any affected deployment
Default ExposureNo non-default configuration was required to be vulnerable — this affected out-of-the-box installations
Scope of ExposureAny principal with pod-log read access, including cloud providers hosting managed Kubernetes log storage
Historical Log RetentionSecrets logged before the upgrade may persist in log storage/backups well past the patch date

Recommendations

Immediate Actions

  1. Upgrade to Contrast 1.8.1 or later if running any older version — and continue on to the latest release, since this exact class of bug reappeared in a later regression (CVE-2025-71423).
  2. Rotate all workload secrets for workloads that ever ran an initializer version prior to 1.8.1.
  3. Purge or restrict access to historical logs covering the vulnerable window, including any downstream log aggregation or SIEM retention.
  4. Explicitly set CONTRAST_LOG_LEVEL to a level that avoids secret-bearing debug/info output where your Contrast version still supports tuning it, as defense in depth alongside upgrading.

Detection

  • Search historical stderr/pod logs for workload-secret-shaped strings dating back to initial deployment.
  • Audit RBAC bindings granting pods/logs access across all namespaces running Contrast-protected workloads.

References