Contour: HTTPProxy cookie rewrite policy injects Lua that runs inside the shared Envoy proxy

Impact

Contour builds its cookie rewriting feature by interpolating user values into Lua source with Go text/template and no sufficient sanitisation, so a crafted pathRewrite.value in an HTTPProxy results in arbitrary code execution inside Envoy. The injected code only runs on the attacker's own route, but Envoy is shared infrastructure: from there it can read Envoy's xDS client credentials off the filesystem and deny service to the other tenants sharing that proxy. On a multi-tenant cluster fronting GPU inference endpoints, one namespace with HTTPProxy write access becomes a foothold against every other tenant's ingress path and against the control-plane trust that xDS credential represents. Fixed in v1.33.4, v1.32.5 and v1.31.6; versions from v1.19.0 are affected.

Who can reach it

A user or workload with RBAC permission to create or modify HTTPProxy resources in any namespace Contour watches. Authenticated cluster access is required; no node-level access is.

What to do

Upgrade Contour to v1.33.4, v1.32.5 or v1.31.6 and roll the Contour and Envoy pods - a daemon restart within the ingress data plane, not a node drain. Treat the xDS client credentials as potentially exposed if untrusted parties held HTTPProxy write access, and rotate them. Where upgrading must wait, restrict HTTPProxy create/update RBAC and use admission policy to reject cookieRewritePolicies.pathRewrite.value.

References

Related entries

• Argo Workflows (controller, hostNetwork / securityContext / serviceAccountName merge path): The first fix forCVE-2026-42296 · Argo Workflows (controller, hostNetwork / securityContext / serviceAccountName merge path)High
• etcd: revoked client certificates still authenticate on the gRPC listener when HTTP and gRPC are splitCVE-2026-59818 · etcd (gRPC client listener with --listen-client-http-urls, --client-crl-file enforcement)High
• containerd: On SELinux hosts, an unprivileged pod with a hostPath volume can gain full read/write to the host filesystemCVE-2021-43816 · containerdHigh
• Cilium: IPsec transparent encryption is cryptographically ineffectiveCVE-2024-28860 · CiliumHigh
• CRI-O: untrusted checkpoint archive on restore allows unintended host filesystem operationsCVE-2026-15801 · CRI-O (container checkpoint/restore metadata validation)High
• Nuclio controller: cron trigger headers and body are injected into the CronJob shell commandCVE-2026-52831 · Nuclio controller (cron trigger rendered into Kubernetes CronJob args)High