{"id":"CVE-2025-71425","aliases":["GHSA-h5f8-crrq-4pw8","GO-2025-3718"],"url":"https://o3.security/vulnerability/CVE-2025-71425","summary":"Contrast before 1.8.1 Information Disclosure via Logging","details":"### Impact\n\nWhen the Contrast initializer is configured with a `CONTRAST_LOG_LEVEL` of `info` or `debug`, the workload secret is logged to `stderr` and written to Kubernetes logs. \n\nSince `info` is the default setting, this affects all Contrast installations that don't customize their initializers' log level.\n\nThe following audiences are **intended** to have access to workload secrets (see https://docs.edgeless.systems/contrast/1.7/architecture/secrets#workload-secrets):\n\n* Contrast Coordinator (can derive all workload secrets)\n* Contrast Initializer (obtains only the secret configured in the manifest)\n* Seedshare owner (can derive all workload secrets)\n* Workload owner (can update manifests to obtain secrets)\n\nThis vulnerability allows the following parties **unintended access** to workload secrets issued by a Coordinator:\n\n* Kubernetes users with `get` or `list` permission on `pods/logs`.\n* Others with read access to the Kubernetes log storage (most notably, the cloud provider).\n\nThis vulnerability **does not affect** scenarios where workload secrets are not used by the application (directly or with [secure persistence](https://docs.edgeless.systems/contrast/1.7/architecture/secrets#secure-persistence)). Applications designed for workload owner exclusion can't use workload secrets and are thus unaffected.\n\n### Patches\n\nN/A\n\n### Workarounds\n\nThis vulnerability can be mitigated by adding an environment variable `CONTRAST_LOG_LEVEL=warn` to the initializer after running `contrast generate`, and then running `contrast generate` again.\n\n### References\n\nN/A","published":"2026-09-27T01:28:27.270Z","modified":"2026-10-28T02:31:00.293880348Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/edgelesssys/contrast","fixedVersion":"1.8.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71425.json"},{"type":"ADVISORY","url":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71425"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/contrast-before-1.8.1-information-disclosure-via-logging"},{"type":"PACKAGE","url":"https://github.com/edgelesssys/contrast"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:00.293880348Z"}}