CVE-2026-41246: 
NixOS vulnerability analysis and mitigation

CVE-2026-41246 is a Lua code injection vulnerability in Contour, a Kubernetes ingress controller using Envoy proxy, affecting versions v1.19.0 through v1.33.3, v1.32.4, and v1.31.5. An attacker with RBAC permissions to create or modify HTTPProxy resources can inject arbitrary Lua code via the cookie rewrite path policy fields, resulting in code execution within the shared Envoy proxy. The vulnerability was published on April 23, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat).

The root cause is improper control of code generation (CWE-94): Contour's cookie rewriting feature is implemented via Envoy's HTTP Lua filter, and user-controlled values from spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value are interpolated directly into Lua source code using Go's text/template package without sufficient sanitization. An attacker with legitimate RBAC access to create or modify HTTPProxy resources can craft a malicious pathRewrite.value containing Lua code that breaks out of the template context and executes within the Envoy process. The injected code executes when HTTP traffic is processed on the attacker's own route, but because Envoy is shared infrastructure, the code runs in a context with access to resources belonging to other tenants (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary Lua code within the shared Envoy proxy process. Because Envoy runs as shared infrastructure, the injected code can read Envoy's xDS client credentials from the filesystem — potentially exposing TLS certificates and private keys belonging to other tenants — and can cause denial of service for other tenants sharing the same Envoy instance. Confidentiality and availability are both rated High, while integrity is not directly impacted by this vulnerability (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires the attacker to already hold Kubernetes RBAC permissions to create or modify HTTPProxy resources, limiting the attack surface to authenticated, privileged cluster users. The EPSS score is approximately 0.072% (0.000720), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain HTTPProxy permissions: Acquire Kubernetes RBAC permissions to create or modify HTTPProxy resources in the target namespace, either through legitimate access or credential compromise.
2. Craft malicious HTTPProxy: Create or modify an HTTPProxy resource with a malicious pathRewrite.value in spec.routes[].cookieRewritePolicies[].pathRewrite.value or spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value. The value should contain Lua code that breaks out of the Go text/template interpolation context, for example by injecting Lua string delimiters and appending arbitrary Lua statements.
3. Apply the resource: Submit the crafted HTTPProxy to the Kubernetes API server (kubectl apply -f malicious-httpproxy.yaml).
4. Trigger execution: Send HTTP traffic to the attacker-controlled route. Contour translates the HTTPProxy into an Envoy Lua filter configuration, and the injected Lua code executes within the Envoy proxy process when the route processes requests.
5. Exfiltrate credentials or cause DoS: Use the injected Lua code to read Envoy's xDS client credentials (e.g., TLS private keys) from the filesystem and exfiltrate them, or execute logic that causes Envoy to crash or degrade service for other tenants sharing the instance (GitHub Advisory).

• Kubernetes API Logs: Unexpected creation or modification of HTTPProxy resources by non-administrative users, particularly those containing unusual characters (e.g., Lua string delimiters ]], --, end) in cookieRewritePolicies[].pathRewrite.value fields.
• Envoy Proxy Logs: Unexpected Lua runtime errors or unusual log output from the HTTP Lua filter; anomalous file read operations logged by Envoy during request processing.
• File System: Evidence of access to Envoy's xDS client credential files (e.g., certificates and private keys stored in the Envoy pod's filesystem, typically under /certs/ or similar paths).
• Network: Unexpected outbound connections from the Envoy proxy pod to external IPs, which may indicate credential exfiltration initiated by injected Lua code.
• Process/Pod Behavior: Envoy pod crashes or restarts that correlate with traffic on specific routes; degraded availability for tenants sharing the Envoy instance (GitHub Advisory).

Upgrade Contour to one of the patched versions: v1.33.4 (removes text/template usage entirely; user-provided values are passed as structured data via Envoy's filterContext — requires Envoy 1.35.0 or later), v1.32.5, or v1.31.6 (both escape user-provided values before interpolation into Lua code). There are no supported workarounds; upgrading is the only remediation. As a defense-in-depth measure, restrict Kubernetes RBAC permissions for creating and modifying HTTPProxy resources to trusted administrators only, and audit existing HTTPProxy resources for suspicious cookieRewritePolicies[].pathRewrite.value entries (GitHub Advisory, v1.33.4 Release, v1.32.5 Release, v1.31.6 Release).

The vulnerability was reported by researchers credited as b0b0haha and kodareef5 in the GitHub Security Advisory. Red Hat tracked the issue via Bugzilla (Bug 2461257) and assigned it a high severity rating. Social media activity was limited, with brief mentions on Mastodon and aggregation by vulnerability tracking services shortly after disclosure (GitHub Advisory, Red Hat Bugzilla).