> CVE-2026-41246 [HIGH]

« BACK_TO_HOME
PUBLISHED
2026-04-23 19:17
MODIFIED
2026-04-23 19:17
CVSS_SCORE V3
8.1
EPSS (Prob. Exploit)
0.49%
Top 57.5%
DATA SOURCES:
NVD 🔗 2026-04-23 RED HAT 🔗 2026-04-26 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-29 OSV 🔗 2026-11-02

> DESCRIPTION

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value that results in arbitrary code execution in the Envoy proxy. The cookie rewriting feature is internally implemented using Envoy's HTTP Lua filter. User-controlled values are interpolated into Lua source code using Go text/template without sufficient sanitization. The injected code only executes when processing traffic on the attacker's own route, which they already control. However, since Envoy runs as shared infrastructure, the injected code can also read Envoy's xDS client credentials from the filesystem or cause denial of service for other tenants sharing the Envoy instance. This vulnerability is fixed in v1.33.4, v1.32.5, and v1.31.6.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EXPLOITABILITY
2.8
IMPACT
5.2

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
Low (L)
Authentifié avec compte utilisateur basique
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Unchanged (U)
Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
High (H)
Divulgation totale d'informations
I (Impact Intégrité)
Integrity Impact
None (N)
Aucune modification de données possible
A (Impact Disponibilité)
Availability Impact
High (H)
Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
High
Divulgation totale d'informations
Intégrité
None
Aucune modification de données possible
Disponibilité
High
Interruption totale du service possible

> WEAKNESSES

CWE-94

> CWE DETAILED DESCRIPTIONS

CWE-94: Improper Control of Generation of Code - The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-x4mj-7f9g-29h4 HIGH

Contour has Lua code injection via Cookie Path Rewrite Policy

AFFECTED PACKAGES:
GO / github.com/projectcontour/contour
>= 1.33.0, < 1.33.4
Fixed in: 1.33.4
GO / github.com/projectcontour/contour
>= 1.32.0, < 1.32.5
Fixed in: 1.32.5
GO / github.com/projectcontour/contour
>= 1.19.0, < 1.31.6
Fixed in: 1.31.6

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Contour: Lua code injection via Cookie Path Rewrite Policy

AFFECTED PACKAGES:
Unknown / Unknown
9 versions affected
ALIASES:
BIT-contour-2026-41246, GHSA-x4mj-7f9g-29h4, GO-2026-5738

> HISTORIQUE DES MODIFICATIONS

Première apparition
23/04/2026 19:17
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-94: Improper Control of Generation of Code ('Code Injection') - The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not n...
Nouvelle valeur:
CWE-94: Improper Control of Generation of Code - The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorr...
📊 ENRICHISSEMENT 01/05/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-94: Improper Control of Generation of Code ('Code Injection') - The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not n...
📊 ENRICHISSEMENT 26/04/2026 05:01
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 26/04/2026 05:01
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 4 Dernière mise à jour: 1 week ago

> REFERENCES

https://github.com/projectcontour/contour/releases/tag/v1.31.6
https://github.com/projectcontour/contour/releases/tag/v1.32.5
https://github.com/projectcontour/contour/releases/tag/v1.33.4
https://github.com/projectcontour/contour/security/advisories/GHSA-x4mj-7f9g-29h...
« BACK_TO_HOME