Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries
# Summary `Config.registryFor` selected a per-registry credential / CA / mirror block by checking `strings.HasSuffix(name, fqdn)` after stripping a single trailing dot. The match has no boundary between the configured FQDN and any preceding characters in the request hostname. A registry configured as `[registries."ghcr.io."]` is therefore also applied to any image pulled from a host whose name happens to end in the literal byte sequence `ghcr.io`, including attacker-registered domains such as `evilghcr.io.` The imagepuller would then send the configured `Authorization` header (basic auth, registry token, or identity token), trust the configured custom CA bundle, follow the configured mirror, or honour `insecure-skip-verify`, on requests to that hostname. # Prerequisites For this to be applicable, an image or layer must be pulled from a "sibling" domain ending in one of the FQDNs configured in the imagepuller config. This may occur due to malicious intent or coincidentally. # Impact - Authentication header leaks to the sibling registry. - If `insecure-skip-verify` is set on an FQDN, TLS will also not be verified for the sibling registry. - Mirrors configured for an FQDN will also be used with the sibling registry. ## Not impacted Image integrity is **not** impacted. Image bytes remain pinned by digest in the policy and are validated after the pull. This advisory does not allow code substitution. # Workaround - If possible, configure explicit subdomains in the imagepuller confi
GHSA-6c87-g9pw-78fx
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-6c87-g9pw-78fx
github.com/edgelesssys/contrast
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.21.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.0"
}
]
}
],
"package": {
"name": "github.com/edgelesssys/contrast",
"purl": "pkg:golang/github.com/edgelesssys/contrast",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-6c87-g9pw-78fx/GHSA-6c87-g9pw-78fx.json",
"last_known_affected_version_range": "<= 1.20.0"
}
}
]- Related CVEs
- CVE-2026-100837
Source reference:
/aliases
Publisher severity
low
Source reference: /database_specific/severity
- Event
- #19706 · Revision 1
- Added to Heist Feed
- Publisher date
GO-2026-5865
Revision 1
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-5865
github.com/edgelesssys/contrast
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.21.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.0"
}
]
}
],
"package": {
"name": "github.com/edgelesssys/contrast",
"purl": "pkg:golang/github.com/edgelesssys/contrast",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-5865.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-100837
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #19707 · Revision 1
- Added to Heist Feed
- Publisher date