Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
Published Aug 19, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.18%
Description
Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProviders`, Contour does not reject the configuration. Consequently, requests from clients that do not send TLS SNI or send an unrecognized SNI (one that does not match any `HTTPProxy` FQDN) bypass configured JWT verification and are proxied to upstream services without a valid token. This issue is fixed in Contour v1.33.5. Contour now rejects and marks invalid any `HTTPProxy` resources that combine `.spec.virtualhost.tls.enableFallbackCertificate: true` with `.spec.virtualhost.jwtProviders`. Affected resources will receive a status condition with the error reason `TLSIncompatibleFeatures`. As a workaround, do not enable `.spec.virtualhost.tls.enableFallbackCertificate` on `HTTPProxy` resources that also define `.spec.virtualhost.jwtProviders`. Remove one of the two settings to avoid the invalid configuration.
Affected products
-
- Version >= 1.23.0, < 1.33.5StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Projectcontour | Contour | n/a |
|
No data.
No data.
ExternalDNS Operator
edo/external-dns-rhel8
Out of support scope
ExternalDNS Operator
edo/external-dns-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-contour-rhel8
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| ExternalDNS Operator | edo/external-dns-rhel8 | Out of support scope | n/a |
| ExternalDNS Operator | edo/external-dns-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-contour-rhel8 | Fix deferred | n/a |
github.com/projectcontour/contour
Go
Introduced 1.23.0 Fixed 1.33.5
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/projectcontour/contour | 1.23.0 | 1.33.5 |
Remediation
Red Hat statement
A flaw was found in Contour. When an HTTPProxy combines enableFallbackCertificate with jwtProviders, requests without TLS SNI bypass JWT verification and are proxied without a valid token.
Red Hat mitigation
Upgrade to Contour v1.33.5 or later. As a workaround, do not enable enableFallbackCertificate on HTTPProxy resources that also define jwtProviders.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Aug 25, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Jun–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.18% (0.00185) | 7.29th | v5 (v2026.06.15) |
| Aug 20, 2026 | 0.15% (0.00147) | 4.49th | v5 (v2026.06.15) |
| Jun 12, 2026 | 0.02% (0.00023) | 6.81th | v4 (v2025.03.14) |
References (6)
- https://access.redhat.com/security/cve/CVE-2026-50149 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2499692 Issue Tracking
- https://github.com/advisories/GHSA-g3xr-5w5j-w4q4 Advisory
- https://github.com/projectcontour/contour/security/advisories/GHSA-g3xr-5w5j-w4q4 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-50149
- https://www.cve.org/CVERecord?id=CVE-2026-50149
Change history (0)
No recorded changes yet.