8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41246

CVE-2026-41246: Contour: Lua code injection via Cookie Path Rewrite Policy

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value that results in arbitrary code execution in the Envoy proxy. The cookie rewriting feature is internally implemented using Envoy's HTTP Lua filter. User-controlled values are interpolated into Lua source code using Go text/template without sufficient sanitization. The injected code only executes when processing traffic on the attacker's own route, which they already control. However, since Envoy runs as shared infrastructure, the injected code can also read Envoy's xDS client credentials from the filesystem or cause denial of service for other tenants sharing the Envoy instance. This vulnerability is fixed in v1.33.4, v1.32.5, and v1.31.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41246

CVE-2026-41246:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/projectcontour/contour	go	>= 1.19.0, < 1.31.6	1.31.6
github.com/projectcontour/contour	go	>= 1.32.0, < 1.32.5	1.32.5
github.com/projectcontour/contour	go	>= 1.33.0, < 1.33.4	1.33.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the insecure construction of Lua scripts that are executed by the Envoy proxy. The analysis of the patches revealed two key functions, cookieRewriteConfig and FilterMisdirectedRequests, that were responsible for this insecure script generation.

The primary vulnerability, as described in the advisory, is within the cookieRewriteConfig function located in internal/envoy/v3/route.go. This function used Go's text/template to generate Lua code for cookie rewriting. User-controlled values for cookie path and domain rewriting were interpolated directly into the Lua script without proper escaping. The patch for this function introduced a luaStringEscape function to sanitize the user input before it is embedded into the template, thus preventing the Lua injection.

A similar issue was found in the FilterMisdirectedRequests function in internal/envoy/v3/listener.go. This function also generated a Lua script and used fmt.Sprintf to inject a hostname into the script. This was also an injection vector. The patch for this function removed the dynamic string formatting altogether, opting for a static script that retrieves the necessary information at runtime in a safe way.

Both of these functions, when exploited, could lead to arbitrary code execution in the context of the Envoy proxy, allowing an attacker to access sensitive information or cause a denial of service. Therefore, both cookieRewriteConfig and FilterMisdirectedRequests are considered vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

cookieRewriteConfig

internal/envoy/v3/route.go

The `cookieRewriteConfig` function in `internal/envoy/v3/route.go` is responsible for generating a Lua script for cookie rewriting based on user-defined policies. It uses Go's `text/template` to construct this script. Before the patch, it directly embedded user-provided values from `dag.CookieRewritePolicy` into the Lua code template without sanitization. This allowed an attacker with permissions to create or modify `HTTPProxy` resources to inject arbitrary Lua code by crafting a malicious `pathRewrite.value` in a cookie rewrite policy. The injected code would then be executed by the Envoy proxy, leading to potential information disclosure or denial of service.

FilterMisdirectedRequests

internal/envoy/v3/listener.go

The `FilterMisdirectedRequests` function in `internal/envoy/v3/listener.go` generates a Lua script to handle misdirected requests. The original implementation used `fmt.Sprintf` to inject a `target` hostname into the Lua script. This `target` could be controlled by a user via the `fqdn` parameter. This created a code injection vulnerability, as a specially crafted hostname could lead to arbitrary Lua code execution within the Envoy proxy. The patch removes this string formatting, mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.