CVE-2026-41246 - Vulnerability Analysis

Overview

Contour v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6 contains a command injection caused by insufficient sanitization of user-controlled values in cookie rewriting Lua scripts, letting attackers with RBAC permissions execute arbitrary code in Envoy proxy, exploit requires attacker control over HTTPProxy resources.

Severity & Score

Impact

Attackers with RBAC can execute arbitrary code in Envoy, read sensitive credentials, or cause denial of service affecting shared infrastructure.

Mitigation

Upgrade to versions v1.33.4, v1.32.5, or v1.31.6 or later.

References

• https://github.com/projectcontour/contour/releases/tag/v1.31.6
• https://github.com/projectcontour/contour/releases/tag/v1.32.5
• https://github.com/projectcontour/contour/releases/tag/v1.33.4
• https://github.com/projectcontour/contour/security/advisories/GHSA-x4mj-7f9g-29h4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner