Read the docs
TI-2026-36918 Aliases CVE-2026-50149GHSA-g3xr-5w5j-w4q4

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Priority LOW 28CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProviders`, Contour does not reject the configuration. Consequently, requests from clients that do not send TLS SNI or send an unrecognized SNI (one that does not match any `HTTPProxy` FQDN) bypass configured JWT verification and are proxied to upstream services without a valid token. This issue is fixed in Contour v1.33.5. Contour now rejects and marks invalid any `HTTPProxy` resources that combine `.spec.virtualhost.tls.enableFallbackCertificate: true` with `.spec.virtualhost.jwtProviders`. Affected resources will receive a status condition with the error reason `TLSIncompatibleFeatures`. As a workaround, do not enable `.spec.virtualhost.tls.enableFallbackCertificate` on `HTTPProxy` resources that also define `.spec.virtualhost.jwtProviders`. Remove one of the two settings to avoid the invalid configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00185 8th percentileScored 2026-11-07
Fix Partial contour (projectcontour): 1.33.5github.com/projectcontour/contour (Go): 1.33.5Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
projectcontourcontour1.23.0 to before 1.33.51.33.5Patch availableCNA
—github.com/projectcontour/contour (Go)1.23.0 to before 1.33.51.33.5Patch availableGHSA-g3xr-5w5j-w4q4
  • contour Vendorprojectcontour Affected 1.23.0 to before 1.33.5 Fixed in 1.33.5 Patch available CNA
  • github.com/projectcontour/contour (Go) Vendor— Affected 1.23.0 to before 1.33.5 Fixed in 1.33.5 Patch available GHSA-g3xr-5w5j-w4q4

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:projectcontour:contour:*:*:*:*:*:*:*:*——projectcontour
  • cpe:2.3:a:projectcontour:contour:*:*:*:*:*:*:*:* Versions — — ·projectcontour

Remediation

  • Fix · CNA contour (projectcontour) Fixed in 1.33.5
  • Fix · GHSA-g3xr-5w5j-w4q4 github.com/projectcontour/contour (Go) Fixed in 1.33.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
ExternalDNS OperatorAffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50149
  2. 2026-10-03 Alias added: GHSA-g3xr-5w5j-w4q4

References

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-24308 Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and… CVSS 3.1CRITICAL 9.8
  • TI-2021-12450 Authorization bypass in Contour CVSS 3.1HIGH 8.5
  • TI-2026-29855 Contour: Lua code injection via Cookie Path Rewrite Policy CVSS 3.1HIGH 8.1
  • TI-2020-11900 Denial of service in Contour CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences