Contour patches Lua injection in cookie rewriting policies
TL;DR — Contour’s Cookie Rewriting feature can be abused for Lua code injection, allowing attackers with HTTPProxy write permissions to execute arbitrary code in the shared Envoy proxy.
What happened
Contour is a Kubernetes ingress controller that programs the Envoy proxy to route and manage inbound HTTP traffic.
CVE-2026-41246 describes a Lua code injection issue in Contour’s Cookie Rewriting feature. The CVE states that an attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value, resulting in arbitrary code execution in the Envoy proxy. The described root cause is that user-controlled values are interpolated into Lua source code via Go text/template without sufficient sanitization.
While the injected code executes on traffic for the attacker’s own route, Envoy is commonly shared infrastructure in platform deployments—so code execution inside the proxy is a control-plane-adjacent failure mode (credential exposure and cross-tenant blast radius are realistic outcomes).
Who is impacted
- Kubernetes clusters running
projectcontour/contourin affected version ranges. - Environments where Contour’s Cookie Rewriting is enabled and where an attacker can obtain RBAC that permits creating/modifying
HTTPProxyresources.
| Component | Affected (per CVE record) | Fixed (per CVE record) |
|---|---|---|
contour | >= 1.19.0, < 1.31.6 | 1.31.6 |
contour | >= 1.32.0, < 1.32.5 | 1.32.5 |
contour | >= 1.33.0, < 1.33.4 | 1.33.4 |
What to do now
- Follow vendor remediation guidance and apply a release that includes the fix; the CVE record states the issue is fixed in
v1.33.4,v1.32.5, andv1.31.6. - Inventory clusters running Contour and identify whether Cookie Rewriting is in use (and where
HTTPProxywrite permissions exist outside your most-trusted operator/admin roles). - Treat this as a shared-infrastructure risk: if multi-tenant workloads can influence
HTTPProxyresources, review RBAC bindings and tenancy boundaries around Contour/Envoy as part of the upgrade rollout.
Content is AI-assisted and reviewed by our team, but issues may be missed and best practices evolve rapidly, send corrections to [email protected]. Always consult official documentation and validate key implementation decisions before making design or security choices.