Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-50149— Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Quick assessment

Affected
projectcontour contour
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Contour 是一个基于 Envoy 代理的 Kubernetes Ingress 控制器。在版本 1.23.0 至 1.33.4 中，当 配置中同时存在 和 的不兼容组合时，Contour 不会拒绝该配置。因此，来自未发送 TLS SNI 或发送了未识别 SNI（即不匹配任何 FQDN 的 SNI）的客户端的请求，将绕过配置的 JWT 验证，并以无效令牌直接代理转发至上游服务。 该问题已在 Contour v1.33.5 中修复。修复后，Contour 将拒绝并将任何同时启用 与 的 资源标记为无效。受影响资源

CVSS 6.5 · Medium EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
projectcontour contour >= 1.23.0, < 1.33.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50149

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
Source: CVE Program / CVE List V5
Vulnerability Description
Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProviders`, Contour does not reject the configuration. Consequently, requests from clients that do not send TLS SNI or send an unrecognized SNI (one that does not match any `HTTPProxy` FQDN) bypass configured JWT verification and are proxied to upstream services without a valid token. This issue is fixed in Contour v1.33.5. Contour now rejects and marks invalid any `HTTPProxy` resources that combine `.spec.virtualhost.tls.enableFallbackCertificate: true` with `.spec.virtualhost.jwtProviders`. Affected resources will receive a status condition with the error reason `TLSIncompatibleFeatures`. As a workaround, do not enable `.spec.virtualhost.tls.enableFallbackCertificate` on `HTTPProxy` resources that also define `.spec.virtualhost.jwtProviders`. Remove one of the two settings to avoid the invalid configuration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
projectcontour contour >= 1.23.0, < 1.33.5 -

II. Public POCs for CVE-2026-50149

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50149

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-50149 (1)

IV. Related Vulnerabilities

Same product: contour
Same vendor: projectcontour
Same weakness: CWE-295

V. Comments for CVE-2026-50149

No comments yet

Leave a comment