CVE-2026-50149

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProviders`, Contour does not reject the configuration. Consequently, requests from clients that do not send TLS SNI or send an unrecognized SNI (one that does not match any `HTTPProxy` FQDN) bypass configured JWT verification and are proxied to upstream services without a valid token. This issue is fixed in Contour v1.33.5. Contour now rejects and marks invalid any `HTTPProxy` resources that combine `.spec.virtualhost.tls.enableFallbackCertificate: true` with `.spec.virtualhost.jwtProviders`. Affected resources will receive a status condition with the error reason `TLSIncompatibleFeatures`. As a workaround, do not enable `.spec.virtualhost.tls.enableFallbackCertificate` on `HTTPProxy` resources that also define `.spec.virtualhost.jwtProviders`. Remove one of the two settings to avoid the invalid configuration.

• CWE-295

• https://github.com/projectcontour/contour/security/advisories/GHSA-g3xr-5w5j-w4q4

Published

Aug 19, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50142libheif is a HEIF and AVIF file format decoder and encoder. …7.5
• CVE-2026-50143The Apify MCP server enables AI agents to extract data from …8.1
• CVE-2026-50144ncnn is a high-performance neural network inference framewor…7.1
• CVE-2026-50146Astro is a web framework. Prior to 6.3.3, when a component u…6.1
• CVE-2026-50147Metabase is an open-source business intelligence and embedde…7.6
• CVE-2026-50148Metabase is an open-source business intelligence and embedde…9.1
• CVE-2026-5015A vulnerability was determined in elecV2 elecV2P up to 3.8.3…4.3
• CVE-2026-50151oras-go is a Go library for managing OCI artifacts. Prior to…7.5
• CVE-2026-50152Ceph is an open-source distributed storage platform providin…9.1
• CVE-2026-50157Auth0 Symfony is a Symfony SDK for Auth0 Authentication and …6.5
• CVE-2026-50158yutu is an AI-powered toolkit for managing and growing YouTu…7.7
• CVE-2026-50159Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3