TI-2021-12450 Aliases CVE-2021-32783 GHSA-5ph6-qq5x-7jwc

Authorization bypass in Contour

LOW 39CWE-441Published 2021-07-23 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS Keypairs. However, it *cannot* be used to get the *content* of those secrets. Since this attack allows access to the administration interface, a variety of administration options are available, such as shutting down the Envoy or draining traffic. In general, the Envoy admin interface cannot easily be used for making changes to the cluster, in-flight requests, or backend services, but it could be used to shut down or drain Envoy, change traffic routing, or to retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch release, v1.17.1, has been released to cover users who cannot upgrade at this time. For more details refer to the linked GitHub Security Advisory.

Why it matters now

EPSS 0.01151 67th percentileScored 2026-11-07

Fix Fixed contour (projectcontour): 1.17.1github.com/projectcontour/contour (Go): 1.14.2, 1.15.2, 1.16.1 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
projectcontour	contour	before 1.17.1	1.17.1	Patch available	CNA
—	github.com/projectcontour/contour (Go)	before 1.14.2	1.14.2	Patch available	GHSA-5ph6-qq5x-7jwc
—	github.com/projectcontour/contour (Go)	1.15.0 to before 1.15.2	1.15.2	Patch available	GHSA-5ph6-qq5x-7jwc
—	github.com/projectcontour/contour (Go)	1.16.0 to before 1.16.1	1.16.1	Patch available	GHSA-5ph6-qq5x-7jwc
—	github.com/projectcontour/contour (Go)	1.17.0 to before 1.17.1	1.17.1	Patch available	GHSA-5ph6-qq5x-7jwc

contour Vendorprojectcontour Affected before 1.17.1 Fixed in 1.17.1 Patch available CNA
github.com/projectcontour/contour (Go) Vendor— Affected before 1.14.2 Fixed in 1.14.2 Patch available GHSA-5ph6-qq5x-7jwc
github.com/projectcontour/contour (Go) Vendor— Affected 1.15.0 to before 1.15.2 Fixed in 1.15.2 Patch available GHSA-5ph6-qq5x-7jwc
github.com/projectcontour/contour (Go) Vendor— Affected 1.16.0 to before 1.16.1 Fixed in 1.16.1 Patch available GHSA-5ph6-qq5x-7jwc
github.com/projectcontour/contour (Go) Vendor— Affected 1.17.0 to before 1.17.1 Fixed in 1.17.1 Patch available GHSA-5ph6-qq5x-7jwc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:projectcontour:contour::::::kubernetes::*	before 1.17.1	Vulnerable	projectcontour

cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:* Versions before 1.17.1 Vulnerable ·projectcontour

Remediation

Fix · CNA contour (projectcontour) Fixed in 1.17.1
Fix · GHSA-5ph6-qq5x-7jwc github.com/projectcontour/contour (Go) Fixed in 1.14.2 Advisory →
Fix · GHSA-5ph6-qq5x-7jwc github.com/projectcontour/contour (Go) Fixed in 1.15.2 Advisory →
Fix · GHSA-5ph6-qq5x-7jwc github.com/projectcontour/contour (Go) Fixed in 1.16.1 Advisory →
Fix · GHSA-5ph6-qq5x-7jwc github.com/projectcontour/contour (Go) Fixed in 1.17.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-32783
2026-10-03 Alias added: GHSA-5ph6-qq5x-7jwc

References

Patch 1

https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e

Advisory 3

Other 4

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2024-24308 Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and… CVSS 3.1CRITICAL 9.8
TI-2026-29855 Contour: Lua code injection via Cookie Path Rewrite Policy CVSS 3.1HIGH 8.1
TI-2020-11900 Denial of service in Contour CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences