CVE-2026-50149

Name of the Vulnerable Software and Affected Versions Contour versions prior to 1.33.5

Description An issue exists when an HTTPProxy is configured with both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders. In this scenario, the system fails to reject the incompatible configuration. As a result, requests from clients that do not provide a TLS Server Name Indication (SNI) or provide an unrecognized SNI bypass the configured JWT verification and are proxied to upstream services without a valid token.

Recommendations Update to version 1.33.5. Do not enable .spec.virtualhost.tls.enableFallbackCertificate on HTTPProxy resources that also define .spec.virtualhost.jwtProviders by removing one of these two settings.