A critical Lua code injection vulnerability in the Project Contour ingress controller allows authenticated attackers with specific RBAC permissions to execute arbitrary code within the Envoy proxy.

This vulnerability involves improper control of code generation (CWE-94) where user-controlled input in cookie rewriting policies is interpolated into Lua source code. An attacker with RBAC permissions to create or modify HTTPProxy resources can trigger this injection, which requires authenticated access to the Kubernetes cluster.

The vulnerability poses a severe risk to multi-tenant Kubernetes environments. Successful exploitation allows an attacker to execute arbitrary code within the shared Envoy proxy infrastructure, potentially leading to the unauthorized exfiltration of sensitive xDS client credentials or widespread denial of service for other tenants. The CVSS score of 8.1 reflects the high impact on confidentiality and availability, necessitating urgent remediation to protect the integrity of the ingress layer.

Immediate Action: Upgrade to Contour version 1.33.4, 1.32.5, or 1.31.6 depending on the currently deployed major release branch.

Proactive Monitoring: Monitor Kubernetes audit logs for unauthorized or suspicious modifications to HTTPProxy resources, particularly those involving cookie rewrite policies.

Compensating Controls: Restrict RBAC permissions for HTTPProxy resource creation to trusted service accounts and implement network policies to isolate sensitive ingress controller traffic.

Public Exploit Available: Unknown

Given the potential for cross-tenant impact within shared infrastructure, administrators must treat this vulnerability with high urgency. Please verify your current Contour deployment version immediately and apply the provided security patches to prevent potential code injection and unauthorized credential access.