Executive brief
Contour, an open-source ingress controller for Kubernetes, is vulnerable to a code injection flaw in its cookie rewriting feature. An attacker with permissions to manage network routing rules can execute malicious code within the Envoy proxy infrastructure. This could allow the attacker to steal sensitive credentials and encryption keys belonging to other users or cause a service outage for the entire platform.
Technical details
A Lua code injection vulnerability exists in Contour's Cookie Rewriting feature due to improper sanitization of user-controlled values. Specifically, values in the 'pathRewrite.value' fields of HTTPProxy resources are interpolated into Lua source code using Go's 'text/template' engine without sufficient escaping. An attacker with RBAC permissions to create or modify HTTPProxy resources can exploit this to execute arbitrary Lua code within the Envoy proxy. While the code executes during the attacker's own route processing, it can be leveraged to read Envoy's xDS client credentials from the filesystem, potentially exposing TLS certificates and private keys of other tenants, or to trigger a denial of service. The issue is fixed in versions 1.33.4, 1.32.5, and 1.31.6.
Affected products
- Project Contour Contour >= 1.19.0, < 1.31.6; >= 1.32.0, < 1.32.5; >= 1.33.0, < 1.33.4
Timeline
- 2026-04-20: disclosed
- 2026-04-23: advisory: NVD publication date
- 2026-04-24: patched: GitHub Advisory published and reviewed