Contour has Lua code injection via Cookie Path Rewrite Policy

Impact Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in the following fields that results in arbitrary code execution in the Envoy proxy: -...

CVE-2026-41246

A flaw was found in Contour, a Kubernetes ingress controller. An attacker with Role-Based Access Control RBAC permissions to manage HTTPProxy resources can exploit a Lua code injection vulnerability within Contour's Cookie Rewriting feature. By crafting a malicious value in specific configuration...

CVE-2026-41246

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

CVE-2026-41246

Contour’s Cookie Rewriting feature (Envoy Lua filter) is vulnerable to Lua code injection from v1.19.0 up to before v1.33.4, v1.32.5, and v1.31.6. An attacker with RBAC to create/modify HTTPProxy resources can inject values into spec.routes[].cookieRewritePolicies[].pathRewrite.value (or services...

CVE-2026-41246 Contour: Lua code injection via Cookie Path Rewrite Policy

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

CVE-2026-41246

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

CVE-2026-41246 Contour: Lua code injection via Cookie Path Rewrite Policy

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

CVE-2026-41246 Contour: Lua code injection via Cookie Path Rewrite Policy

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

CVE-2026-41246: Improper Control of Generation of Code

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

Contour 代码注入漏洞

Contour is an open-source Kubernetes ingress controller that uses Envoy proxies. Versions of Contour from v1.19.0 to v1.33.4, v1.32.5 before v1.32.5, and v1.31.6 before v1.31.6 had a code injection vulnerability. This vulnerability stemmed from the Cookie rewriting feature, which was vulnerable t...

PT-2026-34726

Name of the Vulnerable Software and Affected Versions Contour versions 1.19.0 through 1.31.5 Contour versions 1.32.0 through 1.32.4 Contour versions 1.33.0 through 1.33.3 Description The Cookie Rewriting feature is susceptible to Lua code injection. An attacker with RBAC permissions to create or...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: aws-flb-cloudwatch, bento, crossplane-provider-sql, kubescape-operator, chartmuseum, grpc-health-probe, spire-server, opa-envoy, snyk-cli, crossplane-provider-azure-storage, flux-source-controller, boring-registry, kube-arangodb, kubernetes-csi-external-attacher,...

GHSA-P77J-4MVH-X3M3 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql, spire-server, chartmuseum, crossplane-provider-azure-storage, trivy, tw, gitsign, kubernetes-csi-external-provisioner, crossplane-provider-azure-managedidentity, k8ssandra-client, policy-controller, azurefile-csi, guac,...

CVE-2026-33186 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql, spire-server, chartmuseum, crossplane-provider-azure-storage, trivy, tw, gitsign, kubernetes-csi-external-provisioner, crossplane-provider-azure-managedidentity, k8ssandra-client, policy-controller, azurefile-csi, guac,...

CVE-2026-33186 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, goreleaser, oauth2-proxy-fips, opencost, longhorn-instance-manager, metallb-fips, cass-operator, sftpgo-plugin-eventsearch, knative-eventing, mlrun-log-collector-fips, crossplane-provider-aws-firehose, distribution, ansible-operator,...

GHSA-P77J-4MVH-X3M3 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, goreleaser, oauth2-proxy-fips, opencost, longhorn-instance-manager, metallb-fips, cass-operator, sftpgo-plugin-eventsearch, knative-eventing, mlrun-log-collector-fips, crossplane-provider-aws-firehose, distribution, ansible-operator,...

OPENSUSE-SU-2026:20235-1 Security update for fontforge

This update for fontforge fixes the following issues: Update to version 20251009. Security issues fixed: - CVE-2025-15279: remote code execution via heap-based buffer overflow in BMP file parsing bsc1256013. - CVE-2025-15269: remote code execution via use-after-free in SFD file parsing bsc1256032...

CVE-2025-58187 vulnerabilities

Vulnerabilities for packages: chartmuseum, trivy, kubecolor, policy-controller, guac, cluster-api-helm-controller, custom-pod-autoscaler-operator, docker-credential-gcr, fulcio, bom, rootlesskit, istio, mongo-tools, aws-signer-notation-plugin, oras, wave, cue, helm-set-status, restic,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: kubescape-operator, chartmuseum, whereabouts, amass, boring-registry, kubernetes-csi-external-attacher, mkcert, vault-k8s, mockery, sriov-network-device-plugin, falco-no-driver, vexctl, terraform-provider-sendgrid, opentofu, elvish, falco-exporter,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: kubescape-operator, chartmuseum, whereabouts, amass, boring-registry, kubernetes-csi-external-attacher, mkcert, vault-k8s, mockery, sriov-network-device-plugin, falco-no-driver, vexctl, terraform-provider-sendgrid, opentofu, elvish, falco-exporter,...