Security advisories

medium2026-07-01

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts

GHSA-3ccm-4qq2-5wrp

low2026-07-01

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries

GHSA-6c87-g9pw-78fx

high2026-04-30

Contras Affected by CopyFile Policy Subversion via Symlinks

GHSA-rh99-wc69-c255

high2026-03-26

Contrast BadAML injection allows arbitrary code execution

GHSA-g9ww-x58f-9g6m

medium2025-10-28

Contrast has insecure LUKS2 persistent storage partitions may be opened and used

GHSA-f5p4-p5q5-jv3h

high2025-08-28

Contrast leaks workload secrets to logs on INFO level

GHSA-vxg3-w9rv-rhr2

low2025-07-09

Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points

GHSA-phhq-63jg-fp7r

high2025-05-28

Contrast workload secrets leak to logs on INFO level

GHSA-h5f8-crrq-4pw8

high2025-02-05

Contrast's unauthenticated recovery allows Coordinator impersonation

GHSA-vqv5-385r-2hf8