Contour, a Kubernetes ingress controller that uses Envoy, is vulnerable to improper JWT verification when an HTTPProxy resource simultaneously enables a fallback TLS certificate and a JWT provider. Between Contour versions 1.23.0 and 1.33.4 the controller accepts this conflicting configuration but allows traffic that omits a Server Name Indication or presents an unrecognized SNI to bypass the configured JWT authentication, forwarding requests to upstream services without a valid token. The vulnerability, classified as improper verification of security tokens (CWE‑295), effectively permits unauthenticated access to protected services via crafted TLS connections that exploit the fallback certificate mechanism.

The vulnerability targets Contour deployments from version 1.23.0 up to and including 1.33.4 where an HTTPProxy resource uses both a fallback certificate and a JWT provider. Deployments that match this configuration are vulnerable because the controller does not reject the conflicting settings. Contour version 1.33.5 and later reject such HTTPProxy resources, marking them as invalid and preventing the bypass.

The CVSS base score of 6.5 indicates a moderate risk level. The EPSS score of 0.00147 indicates a very low but nonzero probability of exploitation. The issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by establishing TLS connections that omit a valid SNI or use an unrecognized SNI, causing Contour to bypass JWT validation. The exploit requires only crafted network traffic and no privileged access, meaning any host with the vulnerable Contour configuration could be exposed.