Detections
Analytics

SCA: security update for github.com/projectcontour/contour (GHSA-x4mj-7f9g-29h4)

high Tenable Self-Hosted Container Security Plugin ID 440823

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and
 v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC
 permissions to create or modify HTTPProxy resources can craft a malicious value in
 spec.routes[].cookieRewritePolicies[].pathRewrite.value or
 spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value that results in arbitrary code
 execution in the Envoy proxy. The cookie rewriting feature is internally implemented using Envoy's HTTP
 Lua filter. User-controlled values are interpolated into Lua source code using Go text/template without
 sufficient sanitization. The injected code only executes when processing traffic on the attacker's own
 route, which they already control. However, since Envoy runs as shared infrastructure, the injected code
 can also read Envoy's xDS client credentials from the filesystem or cause denial of service for other
 tenants sharing the Envoy instance. This vulnerability is fixed in v1.33.4, v1.32.5, and v1.31.6.
 (CVE-2026-41246)

Solution

Update the github.com/projectcontour/contour library and its related packages to version 1.31.6 or later.

See Also

https://github.com/advisories/GHSA-x4mj-7f9g-29h4

Plugin Details

Severity: High

ID: 440823

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 4/24/2026

Updated: 6/23/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.62

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2026-41246

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/24/2026

Vulnerability Publication Date: 4/23/2026

Reference Information

CVE: CVE-2026-41246

cwe: CWE-94