CVE-2026-41246: Contour Kubernetes Ingress RCE Vulnerability

CVE-2026-41246 Overview

CVE-2026-41246 is a Lua code injection vulnerability affecting Contour, a Kubernetes ingress controller that uses Envoy proxy. The vulnerability exists in Contour's Cookie Rewriting feature, where user-controlled values in HTTPProxy resources are interpolated into Lua source code using Go text/template without sufficient sanitization. An attacker with RBAC permissions to create or modify HTTPProxy resources can exploit this flaw to achieve arbitrary code execution within the Envoy proxy environment.

Critical Impact
Attackers can execute arbitrary Lua code in the Envoy proxy, potentially reading xDS client credentials from the filesystem or causing denial of service for other tenants sharing the Envoy instance.

Affected Products

Contour versions from v1.19.0 to before v1.33.4
Contour versions from v1.19.0 to before v1.32.5
Contour versions from v1.19.0 to before v1.31.6

Discovery Timeline

April 23, 2026 - CVE-2026-41246 published to NVD
April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41246

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and affects the Cookie Rewriting feature in Contour. The root of the issue lies in how Contour processes HTTPProxy custom resources. When users define cookie rewrite policies through spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value, these values are incorporated directly into Lua code that Envoy's HTTP Lua filter executes.

The vulnerability is exploitable over the network and requires low privileges (RBAC permissions to modify HTTPProxy resources). While the injected code initially runs in the context of the attacker's own route, the shared nature of Envoy infrastructure means the impact extends beyond the attacker's tenant boundary.

Root Cause

The root cause is insufficient input sanitization when using Go's text/template package to interpolate user-controlled values into Lua source code. Contour fails to properly escape or validate the pathRewrite.value field before incorporating it into the Lua script that Envoy will execute. This allows specially crafted input to break out of the intended string context and inject arbitrary Lua statements.

Attack Vector

The attack vector involves an authenticated attacker with Kubernetes RBAC permissions to create or modify HTTPProxy resources. The attacker crafts a malicious HTTPProxy manifest containing Lua code injection payloads within the cookie rewrite policy configuration fields. When Contour processes this HTTPProxy and generates the corresponding Envoy configuration, the malicious Lua code is embedded into Envoy's HTTP Lua filter. Upon receiving traffic matching the attacker's route, Envoy executes the injected code.

The vulnerability allows attackers to:

Read sensitive xDS client credentials from the Envoy filesystem
Cause denial of service affecting other tenants sharing the same Envoy instance
Potentially manipulate traffic processing within the Envoy proxy

Since the exploitation requires RBAC permissions and the injected code executes only when processing traffic on the attacker's route, the attack surface is limited to environments where untrusted users have HTTPProxy modification privileges.

Detection Methods for CVE-2026-41246

Indicators of Compromise

Unusual or malformed pathRewrite.value entries in HTTPProxy resources containing Lua syntax characters such as ]], [[, --, or function calls
Unexpected file access attempts from Envoy processes, particularly targeting xDS credential files
Anomalous CPU or memory consumption in Envoy proxy pods indicating potential denial of service attempts
HTTPProxy resources with suspiciously long or encoded values in cookie rewrite policy fields

Detection Strategies

Implement Kubernetes admission controllers to validate HTTPProxy resources and reject those with suspicious characters in cookie rewrite policy values
Monitor Envoy proxy logs for Lua execution errors or unexpected script behaviors
Deploy runtime security monitoring to detect unauthorized filesystem access from Envoy containers
Review audit logs for HTTPProxy create/update operations from non-administrative users

Monitoring Recommendations

Enable Kubernetes audit logging for all HTTPProxy resource modifications
Configure alerts for Envoy proxy crashes or restarts that may indicate exploitation attempts
Monitor network traffic patterns for anomalies on routes controlled by non-administrative users
Implement resource quotas and limits on Envoy pods to contain denial of service impact

How to Mitigate CVE-2026-41246

Immediate Actions Required

Upgrade Contour to patched versions: v1.33.4, v1.32.5, or v1.31.6
Review existing HTTPProxy resources for suspicious cookie rewrite policy configurations
Audit RBAC policies to ensure only trusted users have permissions to modify HTTPProxy resources
Consider temporarily disabling the Cookie Rewriting feature if not required

Patch Information

Project Contour has released patched versions that address this vulnerability. The fixes are available in the following releases:

For complete vulnerability details and remediation guidance, refer to the GitHub Security Advisory GHSA-x4mj-7f9g-29h4.

Workarounds

Restrict RBAC permissions for HTTPProxy resources to trusted administrators only using Kubernetes Role and ClusterRole configurations
Implement Open Policy Agent (OPA) Gatekeeper or Kyverno policies to validate and reject HTTPProxy resources with potentially malicious cookie rewrite values
Deploy network policies to limit Envoy's filesystem access and egress capabilities
Consider isolating Envoy instances per tenant to limit the blast radius of potential exploitation

bash

# Example: Restrict HTTPProxy modification to admin namespace only
kubectl create clusterrole httpproxy-admin --verb=create,update,patch,delete --resource=httpproxies.projectcontour.io
kubectl create clusterrolebinding httpproxy-admin-binding --clusterrole=httpproxy-admin --group=system:masters