CVE-2026-50149

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50149
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50149.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50149
Aliases
Downstream
Related
Published
2026-08-19T14:16:21Z
Modified
2026-08-27T11:31:13Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
Details

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuration. Consequently, requests from clients that do not send TLS SNI or send an unrecognized SNI (one that does not match any HTTPProxy FQDN) bypass configured JWT verification and are proxied to upstream services without a valid token. This issue is fixed in Contour v1.33.5. Contour now rejects and marks invalid any HTTPProxy resources that combine .spec.virtualhost.tls.enableFallbackCertificate: true with .spec.virtualhost.jwtProviders. Affected resources will receive a status condition with the error reason TLSIncompatibleFeatures. As a workaround, do not enable .spec.virtualhost.tls.enableFallbackCertificate on HTTPProxy resources that also define .spec.virtualhost.jwtProviders. Remove one of the two settings to avoid the invalid configuration.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50149.json"
}
References

Affected packages

Git / github.com/projectcontour/contour

Affected ranges

Type
GIT
Repo
https://github.com/projectcontour/contour
Events
Introduced
4520248139257c38e0e12498c2aedbf811b69950
Fixed
2713ad0e0ebd5d192a53803cef4c1c3a69692b1c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.23.0"
        },
        {
            "fixed": "1.33.5"
        },
        {
            "fixed": "1.33.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50149.json"