GHSA-g3xr-5w5j-w4q4: Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
Contour versions from 1.23.0 up to but not including 1.33.5 have a vulnerability where an invalid configuration combining fallback TLS certificates and JWT providers allows requests without proper TLS SNI to bypass JWT verification. This occurs when HTTPProxy resources enable both .spec.virtualhost.tls.enableFallbackCertificate and .spec.virtualhost.jwtProviders simultaneously. The issue is fixed in Contour v1.33.5, which rejects such invalid configurations.
AI Analysis
Technical Summary
When an HTTPProxy resource in Contour is configured with both .spec.virtualhost.tls.enableFallbackCertificate set to true and .spec.virtualhost.jwtProviders defined, Contour does not reject this incompatible configuration. As a result, client requests that omit TLS Server Name Indication (SNI) or provide an unrecognized SNI bypass the configured JWT verification and are proxied to upstream services without a valid token. This improper JWT verification vulnerability is addressed in Contour v1.33.5, which now rejects HTTPProxy resources combining these settings and marks them invalid with a TLSIncompatibleFeatures error condition.
Potential Impact
Requests lacking TLS SNI or with unrecognized SNI can bypass JWT authentication when the vulnerable configuration is present, potentially allowing unauthorized access to upstream services. The vulnerability impacts confidentiality by allowing unauthenticated requests to reach protected services. Integrity impact is low as the issue concerns authentication bypass rather than data modification. Availability is not affected.
Mitigation Recommendations
Upgrade to Contour version 1.33.5 or later, where the invalid configuration is rejected and marked with an error condition. Alternatively, avoid enabling .spec.virtualhost.tls.enableFallbackCertificate on HTTPProxy resources that also define .spec.virtualhost.jwtProviders. Remove one of these settings to prevent the invalid configuration and ensure JWT verification is enforced.
GHSA-g3xr-5w5j-w4q4: Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
Description
Contour versions from 1.23.0 up to but not including 1.33.5 have a vulnerability where an invalid configuration combining fallback TLS certificates and JWT providers allows requests without proper TLS SNI to bypass JWT verification. This occurs when HTTPProxy resources enable both .spec.virtualhost.tls.enableFallbackCertificate and .spec.virtualhost.jwtProviders simultaneously. The issue is fixed in Contour v1.33.5, which rejects such invalid configurations.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
When an HTTPProxy resource in Contour is configured with both .spec.virtualhost.tls.enableFallbackCertificate set to true and .spec.virtualhost.jwtProviders defined, Contour does not reject this incompatible configuration. As a result, client requests that omit TLS Server Name Indication (SNI) or provide an unrecognized SNI bypass the configured JWT verification and are proxied to upstream services without a valid token. This improper JWT verification vulnerability is addressed in Contour v1.33.5, which now rejects HTTPProxy resources combining these settings and marks them invalid with a TLSIncompatibleFeatures error condition.
Potential Impact
Requests lacking TLS SNI or with unrecognized SNI can bypass JWT authentication when the vulnerable configuration is present, potentially allowing unauthorized access to upstream services. The vulnerability impacts confidentiality by allowing unauthenticated requests to reach protected services. Integrity impact is low as the issue concerns authentication bypass rather than data modification. Availability is not affected.
Mitigation Recommendations
Upgrade to Contour version 1.33.5 or later, where the invalid configuration is rejected and marked with an error condition. Alternatively, avoid enabling .spec.virtualhost.tls.enableFallbackCertificate on HTTPProxy resources that also define .spec.virtualhost.jwtProviders. Remove one of these settings to prevent the invalid configuration and ensure JWT verification is enforced.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g3xr-5w5j-w4q4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-50149"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a46ecc627e9c7971943d961
Added to database: 07/02/2026, 22:57:10 UTC
Last enriched: 07/02/2026, 23:18:49 UTC
Last updated: 07/02/2026, 23:18:49 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.