Lua Code Injection Vulnerability in Contour Kubernetes Ingress Controller by Project Contour
CVE-2026-41246
What is CVE-2026-41246?
The Contour Kubernetes ingress controller, utilizing the Envoy proxy, has a vulnerability associated with its Cookie Rewriting feature. This issue allows an attacker with RBAC permissions to manipulate specific HTTPProxy resource values, enabling Lua code injection. Malicious input in cookie rewrite policies could lead to arbitrary code execution within the Envoy proxy context. This poses risks including exposure of sensitive credentials and potential denial of service to other tenants sharing the Envoy instance. The issue is due to insufficient input sanitization when processing user-controlled values within Lua source code. It is imperative to upgrade to Contour versions v1.33.4, v1.32.5, or v1.31.6 to mitigate this risk.
Affected Version(s)
contour >= 1.33.0, < 1.33.4 < 1.33.0, 1.33.4
contour >= 1.32.0, < 1.32.5 < 1.32.0, 1.32.5
contour >= 1.19.0, < 1.31.6 < 1.19.0, 1.31.6