PT-2026-34726 · Contour+1 · Contour+1

B0B0Haha

+1

·

Published

2026-04-23

·

Updated

2026-04-25

·

CVE-2026-41246

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions Contour versions 1.19.0 through 1.31.5 Contour versions 1.32.0 through 1.32.4 Contour versions 1.33.0 through 1.33.3
Description The Cookie Rewriting feature is susceptible to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can provide malicious values in the spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value variables, leading to arbitrary code execution in the Envoy proxy. This occurs because user-controlled values are interpolated into Lua source code using Go text/template without sufficient sanitization. While the injected code executes only on the attacker's own route, it can be used to read Envoy xDS client credentials from the filesystem—potentially exposing TLS certificates and private keys of other tenants—or cause a denial of service for other tenants sharing the Envoy instance.
Recommendations Update to version 1.31.6. Update to version 1.32.5. Update to version 1.33.4.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-CONTOUR-2026-41246
CVE-2026-41246
GHSA-X4MJ-7F9G-29H4

Affected Products

Contour
Envoy