Contour: Lua code injection via Cookie Path Rewrite Policy
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value that results in arbitrary code execution in the Envoy proxy. The cookie rewriting feature is internally implemented using Envoy's HTTP Lua filter. User-controlled values are interpolated into Lua source code using Go text/template without sufficient sanitization. The injected code only executes when processing traffic on the attacker's own route, which they already control. However, since Envoy runs as shared infrastructure, the injected code can also read Envoy's xDS client credentials from the filesystem or cause denial of service for other tenants sharing the Envoy instance. This vulnerability is fixed in v1.33.4, v1.32.5, and v1.31.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| projectcontour | contour | 1.33.0 to before 1.33.4; 1.32.0 to before 1.32.5; 1.19.0 to before 1.31.6 | 1.33.4, 1.32.5, 1.31.6 | Patch available | CNA |
| — | github.com/projectcontour/contour (Go) | 1.19.0 to before 1.31.6 | 1.31.6 | Patch available | GHSA-x4mj-7f9g-29h4 |
| — | github.com/projectcontour/contour (Go) | 1.32.0 to before 1.32.5 | 1.32.5 | Patch available | GHSA-x4mj-7f9g-29h4 |
| — | github.com/projectcontour/contour (Go) | 1.33.0 to before 1.33.4 | 1.33.4 | Patch available | GHSA-x4mj-7f9g-29h4 |
- contour Vendorprojectcontour Affected 1.33.0 to before 1.33.4; 1.32.0 to before 1.32.5; 1.19.0 to before 1.31.6 Fixed in 1.33.4, 1.32.5, 1.31.6 Patch available CNA
- github.com/projectcontour/contour (Go) Vendor— Affected 1.19.0 to before 1.31.6 Fixed in 1.31.6 Patch available GHSA-x4mj-7f9g-29h4
- github.com/projectcontour/contour (Go) Vendor— Affected 1.32.0 to before 1.32.5 Fixed in 1.32.5 Patch available GHSA-x4mj-7f9g-29h4
- github.com/projectcontour/contour (Go) Vendor— Affected 1.33.0 to before 1.33.4 Fixed in 1.33.4 Patch available GHSA-x4mj-7f9g-29h4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:* | 1.19.0 to before 1.31.6; 1.32.0 to before 1.32.5; 1.33.0 to before 1.33.4 | Vulnerable | projectcontour |
- cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:* Versions 1.19.0 to before 1.31.6; 1.32.0 to before 1.32.5; 1.33.0 to before 1.33.4 Vulnerable ·projectcontour
Remediation
- Fix · CNA contour (projectcontour) Fixed in 1.33.4, 1.32.5, 1.31.6
- Fix · GHSA-x4mj-7f9g-29h4 github.com/projectcontour/contour (Go) Fixed in 1.31.6 Advisory →
- Fix · GHSA-x4mj-7f9g-29h4 github.com/projectcontour/contour (Go) Fixed in 1.32.5 Advisory →
- Fix · GHSA-x4mj-7f9g-29h4 github.com/projectcontour/contour (Go) Fixed in 1.33.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 1 product
- ExternalDNS Operator
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41246
- 2026-10-03 Alias added: GHSA-x4mj-7f9g-29h4
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Other 9
- https://github.com/projectcontour/contour/releases/tag/v1.31.6
- https://github.com/projectcontour/contour/releases/tag/v1.32.5
- https://github.com/projectcontour/contour/releases/tag/v1.33.4
- https://access.redhat.com/security/cve/CVE-2026-41246
- https://bugzilla.redhat.com/show_bug.cgi?id=2461257
- https://github.com/projectcontour/contour
- https://projectcontour.io/docs/1.33/config/cookie-rewriting
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41246.json
- https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/lua_filter
More projectcontour Contour vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-24308 Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and… CVSS 3.1CRITICAL 9.8
- TI-2021-12450 Authorization bypass in Contour CVSS 3.1HIGH 8.5
- TI-2020-11900 Denial of service in Contour CVSS 3.1HIGH 7.5
Sources
- CVE-2026-41246 · CVE Program
- CVE-2026-41246 · NVD
- FIRST EPSS
- GHSA-x4mj-7f9g-29h4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41246 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences