Skip to content
Threat Feed

Product

Contour

1 brief RSS
high advisory

Contour HTTPProxy Lua Code Injection via Cookie Path Rewrite

Contour's Cookie Rewriting feature is vulnerable to Lua code injection; an attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in the `spec.routes[].cookieRewritePolicies[].pathRewrite.value` or `spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value` fields, resulting in arbitrary code execution in the Envoy proxy.

Contour lua code-injection httpproxy cve-2026-41246
2r 3t