Contour CVE-2026-41246

Exploitation requires the attacker to already hold Kubernetes RBAC permissions to create or modify HTTPProxy custom resources in the cluster, and the target Contour must be running a vulnerable version (1.19.0-1.31.5, 1.32.0-1.32.4, or 1.33.0-1.33.3) with the Cookie Rewriting feature usable. The exact injection sink is the pathRewrite.value under spec.routes[].cookieRewritePolicies[] or spec.routes[].services[].cookieRewritePolicies[]. Limiting factors: injected Lua only executes on the attacker's own route (they must drive traffic to it), so this is not a drive-by against arbitrary victims; the elevated impact (credential theft, cross-tenant DoS) depends on Envoy being deployed as shared infrastructure across multiple tenants - in a single-tenant deployment the attacker gains nothing beyond what they already control. No end-user interaction is required.

The vendor CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), reflecting high confidentiality and availability impact but requiring privileges (PR:L). Countervailing signals lower the practical urgency: EPSS is only 0.07% (22nd percentile), CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, and no KEV listing or public POC exists. The critical gating factor understated by AV:N is the RBAC prerequisite - the attacker must already be an authorized tenant able to write HTTPProxy resources, so this is primarily a multi-tenant privilege-boundary/lateral-movement risk rather than an internet-facing unauthenticated RCE. Note a scope consideration: NVD marks S:U, yet the documented impact (reading other tenants' xDS credentials and TLS keys, DoS for co-tenants) crosses a trust boundary, arguably a scope change. Real priority is high for multi-tenant clusters sharing a single Envoy, and low for single-tenant deployments where the attacker already controls all routes.

A tenant holding namespaced RBAC to manage HTTPProxy objects submits a resource whose spec.routes[].cookieRewritePolicies[].pathRewrite.value contains Lua payload that breaks out of the templated string. When the tenant sends traffic to their own route, Envoy executes the injected Lua, reads the xDS client credentials from the pod filesystem, and uses them to pull the full Contour xDS config - exfiltrating other tenants' TLS private keys - or crashes/hangs the shared Envoy to deny service. No public POC is identified, but the crafting is straightforward given the documented sink field.