CVE-2026-41246 is a high-severity code injection vulnerability (CWE-94) in projectcontour's Contour Kubernetes ingress controller, specifically in the Cookie Rewriting feature implemented via Envoy's HTTP Lua filter. Versions from 1.19.0 up to but excluding 1.31.6, 1.32.5, and 1.33.4 are affected. The vulnerability allows an attacker with RBAC permissions to create or modify HTTPProxy resources to inject arbitrary Lua code through crafted values in spec.routes[].cookieRewritePolicies[].pathRewrite.value fields. This code executes within the Envoy proxy process, potentially exposing Envoy's xDS client credentials or causing denial of service for other tenants sharing the Envoy instance. The vulnerability is due to unsafe interpolation of user input into Lua source code using Go text/template without adequate sanitization. Fixed versions are 1.31.6, 1.32.5, and 1.33.4.

An attacker with RBAC permissions to create or modify HTTPProxy resources can achieve arbitrary code execution within the Envoy proxy process by injecting Lua code via cookie rewriting policies. Although the injected code executes only on the attacker's own route, it can read sensitive Envoy xDS client credentials from the filesystem or cause denial of service impacting other tenants sharing the Envoy instance. This elevates the risk of credential compromise and service disruption in multi-tenant environments.

Fixed versions of Contour are 1.31.6, 1.32.5, and 1.33.4. Users should upgrade to one of these versions to remediate the vulnerability. The vendor advisory does not indicate any temporary mitigations or that no action is required. Therefore, upgrading to a fixed version is the recommended remediation.