| id: GO-2026-5865 |
| modules: |
| - module: github.com/edgelesssys/contrast |
| versions: |
| - fixed: 1.21.0 |
| vulnerable_at: 1.20.0 |
| summary: |- |
| Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth |
| credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast |
| ghsas: |
| - GHSA-6c87-g9pw-78fx |
| references: |
| - advisory: https://github.com/edgelesssys/contrast/security/advisories/GHSA-6c87-g9pw-78fx |
| - fix: https://github.com/edgelesssys/contrast/commit/10826b1d82613025767fb094e8aa51a7dcfbd2a1 |
| - web: https://github.com/edgelesssys/contrast/releases/tag/v1.21.0 |
| source: |
| id: GHSA-6c87-g9pw-78fx |
| created: 2026-07-06T17:43:34.620705897-04:00 |
| review_status: UNREVIEWED |
