Medium6.5Red Hat Linux

Medium [CVE-2026-50149] JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration

This medium-severity Red Hat Linux advisory covers CVE-2026-50149 affecting ExternalDNS Operator, Red Hat OpenShift Container Platform 4.

CVE-2026-50149 Published Jul 2, 2026Updated by vendor Jul 2, 2026

CVE-2026-50149

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProviders`, Contour does not reject the configuration.

Consequently, requests from clients that do not send TLS SNI or send an unrecognized SNI (one that does not match any `HTTPProxy` FQDN) bypass configured JWT verification and are proxied to upstream services without a valid token. This issue is fixed in Contour v1.33.5.

Contour now rejects and marks invalid any `HTTPProxy` resources that combine `.spec.virtualhost.tls.enableFallbackCertificate: true` with `.spec.virtualhost.jwtProviders`. Affected resources will receive a status condition with the error reason `TLSIncompatibleFeatures`.

Remove one of the two settings to avoid the invalid configuration. A flaw was found in Contour.

When an HTTPProxy is configured with both a fallback certificate and JWT (JSON Web Token) providers, Contour does not properly enforce JWT verification. This allows remote attackers to bypass security checks by sending requests without a valid token, specifically when clients do not provide a TLS Server Name Indication (SNI) or provide an unrecognized SNI.

Affected versions

1.23.0
1.33.4

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Fixed versions

33.5

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Upgrade to Contour v1.33.5 or later. As a workaround, do not enable enableFallbackCertificate on HTTPProxy resources that also define jwtProviders.

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.