contour vulnerabilities

1 known vulnerability in contour from Projectcontour. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  contour: Improper Control of Generation of Code

  CVE-2026-41246Apr 23, 2026Projectcontour

  Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resource