| id: GO-2026-5865 | |
| modules: | |
| - module: github.com/edgelesssys/contrast | |
| versions: | |
| - fixed: 1.21.0 | |
| vulnerable_at: 1.20.0 | |
| summary: |- | |
| Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth | |
| credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast | |
| ghsas: | |
| - GHSA-6c87-g9pw-78fx | |
| references: | |
| - advisory: https://github.com/edgelesssys/contrast/security/advisories/GHSA-6c87-g9pw-78fx | |
| - fix: https://github.com/edgelesssys/contrast/commit/10826b1d82613025767fb094e8aa51a7dcfbd2a1 | |
| - web: https://github.com/edgelesssys/contrast/releases/tag/v1.21.0 | |
| source: | |
| id: GHSA-6c87-g9pw-78fx | |
| created: 2026-07-06T17:43:34.620705897-04:00 | |
| review_status: UNREVIEWED |