CVE-2026-109359
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer…
- Risk score
- 46/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificate…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.24.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
Original description
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.
Last activity 12 Oct 2026. Patch Forecast updates every hour.