Review reviewHigh

CVE-2026-41246

projectcontour contour, ExternalDNS Operator

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value that results in arbitrary code execution in the Envoy proxy. The cookie rewriting feature is internally implemented using Envoy's HTTP Lua filter. User-controlled values are inte...

CVSS: 8.1
EPSS: 0.48%
CISA KEV: Not listed
Published: 2026.04.24

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.48%

Technical severityCVSS 8.1

Vulnerability overview

Affected product and versions

Product: projectcontour contour, ExternalDNS Operator
Affected versions: >= >= 1.33.0, < 1.33.4, >= >= 1.32.0, < 1.32.5, >= >= 1.19.0, < 1.31.6, >= 1.19.0 < 1.31.6, >= 1.32.0 < 1.32.5, >= 1.33.0 < 1.33.4
Fixed versions: 1.31.6, 1.32.5, 1.33.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that projectcontour contour, ExternalDNS Operator and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE: CWE-94