LiveActive security incident?Get immediate response
CVE Record

CVE-2026-41246: Contour: Lua code injection via Cookie Path Rewrite Policy

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value that results in arbitrary code execution in the Envoy proxy. The cookie rewriting feature is internally implemented using Envoy's HTTP Lua filter. User-controlled values are interpolated into Lua source code using Go text/template without sufficient sanitization. The injected code only executes when processing traffic on the attacker's own route, which they already control. However, since Envoy runs as shared infrastructure, the injected code can also read Envoy's xDS client credentials from the filesystem or cause denial of service for other tenants sharing the Envoy instance. This vulnerability is fixed in v1.33.4, v1.32.5, and v1.31.6.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Contour, a Kubernetes ingress controller, could let a user who already has permission to edit HTTPProxy routes inject Lua code into the shared Envoy proxy through cookie path rewriting. The business risk is tenant-to-tenant impact: stolen Envoy xDS credentials or denial of service from infrastructure shared across routes.

Executive priority

Prioritize remediation for shared Kubernetes ingress environments, especially multi-tenant clusters. This is not unauthenticated internet exposure, but it can turn delegated route management into control over shared proxy infrastructure.

Technical view

Affected Contour versions v1.19.0 through unfixed v1.31.x, v1.32.x, and v1.33.x interpolate cookieRewritePolicies pathRewrite values into Envoy HTTP Lua filter source using Go text/template without sufficient sanitization. Execution is limited to traffic on the attacker-controlled route, but the Envoy process is shared infrastructure.

Likely exposure

Exposure is likely in Kubernetes environments running Contour before v1.31.6, v1.32.5, or v1.33.4 where untrusted or lower-trust users can create or modify HTTPProxy resources using Cookie Rewriting.

Exploitation context

The supplied sources do not state active exploitation, and KEV is false. Exploitation requires authenticated Kubernetes RBAC permission to create or modify HTTPProxy resources and traffic reaching the attacker’s own route.

Researcher notes

Key boundaries matter: the attacker already controls their route, but code runs inside Envoy. Validate version, RBAC delegation, and Cookie Rewriting usage before estimating blast radius. Do not assume products beyond Contour are affected from the supplied evidence.

Mitigation direction

  • Upgrade Contour to v1.31.6, v1.32.5, v1.33.4, or later supported releases.
  • Restrict HTTPProxy create and update permissions to trusted operators only.
  • Review use of cookieRewritePolicies pathRewrite values in tenant-controlled routes.
  • Consult Contour and platform vendor guidance for temporary controls if upgrade is delayed.

Validation and detection

  • Inventory deployed Contour versions across all clusters and environments.
  • Search HTTPProxy resources for cookieRewritePolicies with pathRewrite values.
  • Review Kubernetes RBAC subjects allowed to create or modify HTTPProxy resources.
  • Check Envoy logs and pod health for unexplained errors or denial-of-service symptoms.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-94: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-41246 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H2.85.2GitHub_M
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H2.85.2redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2026-41246Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPContour: Envoy: github.com/projectcontour/contour: Contour: Arbitrary Code Execution and Denial of Service via Lua Code Injection
other:Red Hat severity ratingcvssV3_1
  • 2026-04-23T20:01:47.199Z: Reported to Red Hat.
  • 2026-04-23T18:44:39.907Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
projectcontourcontour>= 1.33.0, < 1.33.4, >= 1.32.0, < 1.32.5, >= 1.19.0, < 1.31.6Listed
Weakness

CWE details

CWE-94

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-94 · source CWE mapping

Improper Control of Generation of Code ('Code Injection')

Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs