Contrast’s Isolation Paths
A hostile host could exploit identity, file-transfer and firmware paths into confidential workloads without breaking memory encryption.
Authenticating the wrong machine
Exploiting CVE-2026-100835 requires intercepting client-to-coordinator or coordinator-to-workload traffic and forged reports or secrets stolen from any controlled trusted-execution machine, including one other than the victim. Valid signatures plus expected software and firmware measurements could still authenticate the wrong hardware, enabling impersonation in attested TLS.
Version 1.16.0 provides a workaround, not a software-only repair: populate AllowedChipIDs (AMD SEV-SNP) or AllowedPIIDs (Intel TDX) using physically protected hardware.
File transfers could surrender the guest
Host processes reaching the Kata agent VSOCK could abuse CopyFile verification in command-line-generated policies to overwrite any guest-root file, alter startup or expose secrets, taking control of the guest. CVE-2026-100838 was fixed in 1.19.1.
Regenerate policies after upgrading; binary replacement alone can retain old decisions. The vendor offers a harder policy-only alternative for binary-data checks when upgrading is impossible. Host input remains untrusted.
Firmware input reached private memory
CVE-2026-100839 is BadAML, a generic technique disclosed in 2024. QEMU supplies ACPI tables through OVMF; Linux’s kernel interprets their programmable AML with access to all guest memory.
Fix 1.18.0 protects AMD SEV-SNP’s Metal-QEMU-SNP and Metal-QEMU-SNP-GPU: each load or store checks memory mappings. Malicious programs still execute; private-page reads and writes are blocked. The host retains read and write access to shared allocations. Intel TDX’s Metal-QEMU-TDX is unaffected because firmware measures the tables into runtime measurement register zero.
Check isolation
- Verify actual branch fixes; version order alone is insufficient. Identity controls remain mandatory.
- Match populated allowlists to physically protected hardware, beyond signature success.
- Confirm regenerated policies reached running workloads.
- Inventory affected platforms, host-to-agent sockets and coordinator paths.
- Investigate unexpected copies or firmware changes; neither proves exploitation.
- Review policy and firmware interfaces alongside encryption.
For a different deployment’s identity-and-measurement questions, see BlackTree’s Apple and Google analysis; no shared exploit is implied.
Disclosure chronology
The notices report no attacks; later exploitation remains unexcluded.
- Identity notice: 2026-07-29 07:32:25 UTC.
- File-transfer notice: 2026-04-23 06:55:03 UTC; updated 06:58:50.
- Firmware notice: 2026-03-24 06:05:21 UTC.
September indexing was neither a new disclosure nor an observed attack. NVD published the matching identity, file-transfer and firmware records on 2026-09-27 at 02:17:21–02:17:22 UTC. Their pages say enrichment is not prioritised; the API status remains Deferred. CISA’s no-exploitation assessment dates from 30 September, not today.
Times are UTC; Madrid was one hour ahead in March, two in April, July and September. Reviewed 28 October 2026.
