CVE-2026-41246: Contour Envoy Lua Injection
Dynamically constructing Envoy Lua filter scripts via string interpolation or templates allows Lua code injection. User-controlled values injected into the script source can execute arbitrary code within the proxy. Configure static Lua scripts and pass dynamic variables through Envoy's `FilterContext` or stream data instead.
Gogreprules fetch cve-2026-41246-contour-envoy-lua-injection --engine opengrepDescription
Dynamically constructing Envoy Lua filter scripts via string interpolation or templates allows Lua code injection. User-controlled values injected into the script source can execute arbitrary code within the proxy. Configure static Lua scripts and pass dynamic variables through Envoy's `FilterContext` or stream data instead.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.