projectcontour up to 1.31.5/1.32.4/1.33.3 Cookie Rewriting Feature code injection

Summaryinfo

A vulnerability described as critical has been identified in projectcontour contour up to 1.31.5/1.32.4/1.33.3. This affects an unknown part of the component Cookie Rewriting Feature. The manipulation of the argument spec.routes[].cookieRewritePolicies[].pathRewrite.value/spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value results in code injection. This vulnerability is identified as CVE-2026-41246. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in projectcontour contour up to 1.31.5/1.32.4/1.33.3. It has been classified as critical. Affected is an unknown code block of the component Cookie Rewriting Feature. The manipulation of the argument spec.routes[].cookieRewritePolicies[].pathRewrite.value/spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value that results in arbitrary code execution in the Envoy proxy. The cookie rewriting feature is internally implemented using Envoy's HTTP Lua filter. User-controlled values are interpolated into Lua source code using Go text/template without sufficient sanitization. The injected code only executes when processing traffic on the attacker's own route, which they already control. However, since Envoy runs as shared infrastructure, the injected code can also read Envoy's xDS client credentials from the filesystem or cause denial of service for other tenants sharing the Envoy instance. This vulnerability is fixed in v1.33.4, v1.32.5, and v1.31.6.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-41246 since 04/18/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 1.31.6, 1.32.5 or 1.33.4 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• projectcontour

Name

• contour

Version

• 1.31.0
• 1.31.1
• 1.31.2
• 1.31.3
• 1.31.4
• 1.31.5
• 1.32.0
• 1.32.1
• 1.32.2
• 1.32.3
• 1.32.4
• 1.33.0
• 1.33.1
• 1.33.2
• 1.33.3

Website

• Product: https://github.com/projectcontour/contour/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion