CVE-2026-116197

The record

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

Affected packages

Related vulnerabilities

• CVE-2026-116870 In affected versions of Octopus Server, OIDC token issuer validation was performed… CWE-1289
• CVE-2026-114348 webpack-dev-server is a development server that provides live reloading for webpack… CWE-1289
• CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
• CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
• CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289
• CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia… CWE-1289
• CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode… CWE-1289
• CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal… CWE-1289