Executive brief
Project Contour, a networking tool used to manage traffic in Kubernetes environments, contains a security flaw where identity verification can be bypassed. When specific settings for fallback security certificates and identity tokens are used together, the system fails to enforce security checks for certain types of web requests. This could allow an unauthorized user to access internal services without providing the required credentials, potentially leading to data exposure.
Technical details
A vulnerability exists in Project Contour's HTTPProxy configuration logic where the simultaneous enablement of '.spec.virtualhost.tls.enableFallbackCertificate' and '.spec.virtualhost.jwtProviders' is not properly validated. When this incompatible configuration is present, requests that do not include a TLS Server Name Indication (SNI) or provide an unrecognized SNI are incorrectly routed to upstream services without undergoing the mandated JWT verification. This allows an unauthenticated attacker to bypass security controls and access protected backend services. The issue is resolved in version 1.33.5, which now rejects such configurations with a 'TLSIncompatibleFeatures' error.
Affected products
- Project Contour Contour >= 1.23.0, < 1.33.5
Timeline
- 2026-05-28: disclosed
- 2026-07-02: advisory
- 2026-07-02: patched: Fixed in v1.33.5