CVE-2026-50149
Received Received - Intake

JWT Bypass via TLS Fallback in Contour Ingress

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProviders`, Contour does not reject the configuration. Consequently, requests from clients that do not send TLS SNI or send an unrecognized SNI (one that does not match any `HTTPProxy` FQDN) bypass configured JWT verification and are proxied to upstream services without a valid token. This issue is fixed in Contour v1.33.5. Contour now rejects and marks invalid any `HTTPProxy` resources that combine `.spec.virtualhost.tls.enableFallbackCertificate: true` with `.spec.virtualhost.jwtProviders`. Affected resources will receive a status condition with the error reason `TLSIncompatibleFeatures`. As a workaround, do not enable `.spec.virtualhost.tls.enableFallbackCertificate` on `HTTPProxy` resources that also define `.spec.virtualhost.jwtProviders`. Remove one of the two settings to avoid the invalid configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-50149
EUVD
EUVD-2026-62414

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
projectcontour contour From 1.23.0 (inc) to 1.33.4 (inc)
projectcontour contour 1.33.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50149 is an improper JWT verification vulnerability in Contour, a Kubernetes ingress controller. When an HTTPProxy is configured with both TLS fallback certificates enabled and JWT providers, requests from clients without valid TLS SNI or with unrecognized SNI bypass JWT checks and are proxied upstream without authentication.

Detection Guidance

Check Contour versions between 1.23.0 and 1.33.4 for HTTPProxy resources with both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders. Use kubectl get httpproxy --all-namespaces -o yaml to inspect configurations.

Impact Analysis

This vulnerability allows unauthorized users to access protected services without valid tokens, potentially leading to data breaches or unauthorized actions. Attackers could exploit misconfigured HTTPProxy settings to bypass authentication and interact with upstream services.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and authentication, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized access risks non-compliance with these regulations.

Mitigation Strategies

Upgrade Contour to version 1.33.5 or later. If upgrading is not possible, remove either .spec.virtualhost.tls.enableFallbackCertificate or .spec.virtualhost.jwtProviders from affected HTTPProxy resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart