CVE-2026-41246 Overview
CVE-2026-41246 is a Lua code injection vulnerability affecting Contour, a Kubernetes ingress controller that uses Envoy proxy. The vulnerability exists in Contour's Cookie Rewriting feature, where user-controlled values in HTTPProxy resources are interpolated into Lua source code using Go text/template without sufficient sanitization. An attacker with RBAC permissions to create or modify HTTPProxy resources can exploit this flaw to achieve arbitrary code execution within the Envoy proxy environment.
Critical Impact
Attackers can execute arbitrary Lua code in the Envoy proxy, potentially reading xDS client credentials from the filesystem or causing denial of service for other tenants sharing the Envoy instance.
Affected Products
- Contour versions from v1.19.0 to before v1.33.4
- Contour versions from v1.19.0 to before v1.32.5
- Contour versions from v1.19.0 to before v1.31.6
Discovery Timeline
- April 23, 2026 - CVE-2026-41246 published to NVD
- April 23, 2026 - Last updated in NVD database
Technical Details for CVE-2026-41246
Vulnerability Analysis
This vulnerability is classified as Code Injection (CWE-94) and affects the Cookie Rewriting feature in Contour. The root of the issue lies in how Contour processes HTTPProxy custom resources. When users define cookie rewrite policies through spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value, these values are incorporated directly into Lua code that Envoy's HTTP Lua filter executes.
The vulnerability is exploitable over the network and requires low privileges (RBAC permissions to modify HTTPProxy resources). While the injected code initially runs in the context of the attacker's own route, the shared nature of Envoy infrastructure means the impact extends beyond the attacker's tenant boundary.
Root Cause
The root cause is insufficient input sanitization when using Go's text/template package to interpolate user-controlled values into Lua source code. Contour fails to properly escape or validate the pathRewrite.value field before incorporating it into the Lua script that Envoy will execute. This allows specially crafted input to break out of the intended string context and inject arbitrary Lua statements.
Attack Vector
The attack vector involves an authenticated attacker with Kubernetes RBAC permissions to create or modify HTTPProxy resources. The attacker crafts a malicious HTTPProxy manifest containing Lua code injection payloads within the cookie rewrite policy configuration fields. When Contour processes this HTTPProxy and generates the corresponding Envoy configuration, the malicious Lua code is embedded into Envoy's HTTP Lua filter. Upon receiving traffic matching the attacker's route, Envoy executes the injected code.
The vulnerability allows attackers to:
- Read sensitive xDS client credentials from the Envoy filesystem
- Cause denial of service affecting other tenants sharing the same Envoy instance
- Potentially manipulate traffic processing within the Envoy proxy
Since the exploitation requires RBAC permissions and the injected code executes only when processing traffic on the attacker's route, the attack surface is limited to environments where untrusted users have HTTPProxy modification privileges.
Detection Methods for CVE-2026-41246
Indicators of Compromise
- Unusual or malformed pathRewrite.value entries in HTTPProxy resources containing Lua syntax characters such as ]], [[, --, or function calls
- Unexpected file access attempts from Envoy processes, particularly targeting xDS credential files
- Anomalous CPU or memory consumption in Envoy proxy pods indicating potential denial of service attempts
- HTTPProxy resources with suspiciously long or encoded values in cookie rewrite policy fields
Detection Strategies
- Implement Kubernetes admission controllers to validate HTTPProxy resources and reject those with suspicious characters in cookie rewrite policy values
- Monitor Envoy proxy logs for Lua execution errors or unexpected script behaviors
- Deploy runtime security monitoring to detect unauthorized filesystem access from Envoy containers
- Review audit logs for HTTPProxy create/update operations from non-administrative users
Monitoring Recommendations
- Enable Kubernetes audit logging for all HTTPProxy resource modifications
- Configure alerts for Envoy proxy crashes or restarts that may indicate exploitation attempts
- Monitor network traffic patterns for anomalies on routes controlled by non-administrative users
- Implement resource quotas and limits on Envoy pods to contain denial of service impact
How to Mitigate CVE-2026-41246
Immediate Actions Required
- Upgrade Contour to patched versions: v1.33.4, v1.32.5, or v1.31.6
- Review existing HTTPProxy resources for suspicious cookie rewrite policy configurations
- Audit RBAC policies to ensure only trusted users have permissions to modify HTTPProxy resources
- Consider temporarily disabling the Cookie Rewriting feature if not required
Patch Information
Project Contour has released patched versions that address this vulnerability. The fixes are available in the following releases:
For complete vulnerability details and remediation guidance, refer to the GitHub Security Advisory GHSA-x4mj-7f9g-29h4.
Workarounds
- Restrict RBAC permissions for HTTPProxy resources to trusted administrators only using Kubernetes Role and ClusterRole configurations
- Implement Open Policy Agent (OPA) Gatekeeper or Kyverno policies to validate and reject HTTPProxy resources with potentially malicious cookie rewrite values
- Deploy network policies to limit Envoy's filesystem access and egress capabilities
- Consider isolating Envoy instances per tenant to limit the blast radius of potential exploitation
# Example: Restrict HTTPProxy modification to admin namespace only
kubectl create clusterrole httpproxy-admin --verb=create,update,patch,delete --resource=httpproxies.projectcontour.io
kubectl create clusterrolebinding httpproxy-admin-binding --clusterrole=httpproxy-admin --group=system:masters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
