—

GO-2026-5865

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast

Quick fix

GO-2026-5865 — github.com/edgelesssys/contrast: upgrade to the fixed version with the command below.

go get github.com/edgelesssys/contrast@v1.21.0

Details

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/edgelesssys/contrast

Introduced in: 0Fixed in: 1.21.0

Fixgo get github.com/edgelesssys/contrast@v1.21.0

References

https://github.com/edgelesssys/contrast/security/advisories/GHSA-6c87-g9pw-78fx[ADVISORY]
https://github.com/edgelesssys/contrast/commit/10826b1d82613025767fb094e8aa51a7dcfbd2a1[FIX]
https://github.com/edgelesssys/contrast/releases/tag/v1.21.0[WEB]