CVE-2026-100833 is a critical (CVSS 9.6) flaw in Contrast, the confidential container project from Edgeless Systems. Versions 1.14.0 through 1.23.0 generate runtime policies that do not catch every container image substitution. The fixed releases are v1.23.1 and v1.24.0. Upgrade, and regenerate the policy you deploy.
What's affected
Per the GitHub advisory, affected versions are v1.14.0 through v1.23.0. Patched versions are v1.23.1 and v1.24.0. The advisory lists no package name, because Contrast is a tool and a runtime rather than a library you import.
The threat model matters. The attacker needs access to the Kata agent API, for example a Kubernetes cluster administrator. Contrast's promise is that even that person cannot tamper with your confidential workload, so a gap here weakens the core guarantee. A substituted image still has to satisfy the other policy rules.
How to check if you're exposed
Work out which Contrast release generated each policy you deploy:
- Check the version of the Contrast CLI you use to run
contrast generate, and the version of the Contrast runtime in your cluster. Anything from 1.14.0 through 1.23.0 is in range. - Look in your deployment pipeline or release notes for when the policy was last generated.
- The advisory describes the bad rule as an
allow_storagerule in the generatedrules.regothat accepts theimage_guest_pulldriver without checking an image digest. If you can read your generated rules file, you can look for that rule.
What to do now
- Upgrade Contrast to v1.23.1 or v1.24.0.
- Regenerate the policy for every workload using the new release and redeploy. The advisory's workaround is itself a regeneration, so expect to do this step.
- If you cannot upgrade at once, follow the workaround in the advisory: run
contrast generate, remove the vulnerable rule fromrules.rego, then runcontrast generateagain. Read the advisory first, as it includes a diff for v1.23.0. - Review who holds cluster administrator access, since that is the actor in the threat model.
- Check the advisory for later notes before you close the work item.
Why it matters
The advisory is candid about the cause. A bad rebase during an update of the Kata Containers dependency accidentally added a rule that accepts storage entries for guest-pulled images without verifying the image digest. Nobody wrote it on purpose.
The weakness is classed as CWE-20, improper input validation. In practice it is a policy that is looser than it looks. The policy is the artifact you trust, and a generated file can hide a regression that no test of your own application would catch. Pinning image digests and comparing generated policies between releases are cheap ways to notice that sort of drift.
The KEV flag is false and neither the record nor the advisory reports exploitation.
Quick check
Is this a risk for ordinary Kubernetes clusters without Contrast?
No. It concerns the policies Contrast generates for confidential containers. If you do not run Contrast, it does not apply.
Sources
Last reviewed: 19 October 2026.
