Introduction
A Lua code injection flaw in the Contour Kubernetes ingress controller lets an attacker with modest RBAC privileges execute arbitrary code inside a shared Envoy proxy instance. From there, the attacker may be able to read xDS credentials and TLS private keys that belong to other tenants. The vulnerability is tracked as CVE-2026-41246, has a CVSS score of 8.1, and affects all Contour versions from v1.19.0 onward. No workarounds are available.
Project Contour is an open-source Kubernetes ingress controller that deploys the Envoy proxy as a reverse proxy and load balancer. It supports dynamic configuration updates through multiple APIs, including standard Ingress, the custom HTTPProxy API, and the newer Gateway API. Contour is a CNCF project and is widely used in multi-tenant Kubernetes environments, where teams and services share Envoy instances.
Technical information
Root cause: unsanitized template interpolation
The vulnerability is classified under CWE 94 (Improper Control of Generation of Code). Contour implements its Cookie Rewriting feature with Envoy's HTTP Lua filter. In vulnerable versions, Contour takes user-controlled values from HTTPProxy custom resources and interpolates them directly into Lua source code with Go's text/template package, without sufficient sanitization.
The two vulnerable YAML paths in HTTPProxy manifests are:
spec.routes[].cookieRewritePolicies[].pathRewrite.valuespec.routes[].services[].cookieRewritePolicies[].pathRewrite.value
When Contour processes an HTTPProxy resource that contains a cookie rewrite policy, it embeds the pathRewrite.value string into a Lua script for Envoy's HTTP Lua filter to load. text/template does no Lua-specific escaping, so an attacker can craft a value that breaks out of the intended string literal and injects arbitrary Lua statements.
Attack flow
Exploitation proceeds in five steps:
-
The attacker needs Kubernetes RBAC permissions to create or modify HTTPProxy resources. The CVSS assessment rates this as a "Low" privilege requirement, because many development teams in multi-tenant clusters have this level of access.
-
The attacker creates or modifies an HTTPProxy resource and places a malicious Lua payload in one of the two
pathRewrite.valuefields. The payload is built to escape the string interpolation context inside the generated Lua template. -
Contour processes the HTTPProxy resource and generates a Lua script with Go's
text/template, embedding the attacker's unsanitized value directly in the source code. -
Envoy loads the generated script into its HTTP Lua filter, which executes scripts as coroutines during request and response processing. The injected code runs with the full privileges of the Lua filter whenever traffic hits the attacker's route.
-
The code only triggers on the attacker's own route (which they already control), but Envoy runs as shared infrastructure, so the impact crosses tenants. The injected Lua code can:
- Read Envoy's xDS client credentials from the filesystem
- Access all Contour xDS configuration data, including TLS certificates and private keys belonging to other tenants
- Cause denial of service for all other tenants sharing the same Envoy instance
CVSS breakdown
| Metric | Value | Notes |
|---|---|---|
| Base Score | 8.1 High | |
| Attack Vector | Network | Exploitable over a network connection |
| Privileges Required | Low | Requires RBAC permissions for HTTPProxy resources |
| Confidentiality Impact | High | xDS credentials and TLS keys can be exposed |
| Availability Impact | High | Denial of service across shared Envoy instances |
Scope
The advisory states that Contour's other uses of the Lua filter are not vulnerable. The risk is limited to the Cookie Rewriting feature and the two pathRewrite.value fields.
Affected systems and versions
The vulnerability affects Contour versions from v1.19.0 up to (but not including) the following patched releases:
| Branch | Patched Version | Fix Approach | Envoy Requirement |
|---|---|---|---|
| 1.33.x | v1.33.4 | Removes text/template entirely and passes structured data via Envoy filterContext | Envoy 1.35.0 or later |
| 1.32.x | v1.32.5 | Escapes user-provided values before interpolation into Lua code | Standard branch requirements |
| 1.31.x | v1.31.6 | Escapes user-provided values before interpolation into Lua code | Standard branch requirements |
Version v1.33.4 has the most complete fix, because it removes the vulnerable code generation pattern altogether. It relies on the filterContext mechanism, though, so it requires Envoy 1.35.0 or later. Organizations running older Envoy versions should target v1.32.5 or v1.31.6.
Any Contour deployment that uses the Cookie Rewriting feature with user-modifiable HTTPProxy resources is directly exposed. Deployments that restrict HTTPProxy creation to trusted platform administrators carry lower practical risk, though the vulnerable code path is still present.
Vendor security history
Project Contour maintains a public security advisories page on GitHub. The project has disclosed and patched several high-severity issues over the years:
| Year | Advisory ID | Severity | Description |
|---|---|---|---|
| 2026 | GHSA-x4mj-7f9g-29h4 | High | Lua code injection via Cookie Path Rewrite Policy |
| 2021 | GHSA-5ph6-qq5x-7jwc | High | ExternalName Services access to Envoy admin interface |
| 2020 | GHSA-mjp8-x484-pm3r | High | Ingress data plane denial of service |
The project consistently coordinates patches across multiple supported branches and publishes detailed advisories. Researcher tsaarni reported CVE-2026-41246, and the project disclosed it through the GitHub Security Advisory process on April 20, 2026, with patched releases available at the time of disclosure.
