Calico Cloud
Monthly
Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.
Tier authorization bypass in Tigera Calico's apiserver allows an authenticated high-privileged user to bulk-delete NetworkPolicy, GlobalNetworkPolicy, and their staged variants across restricted tiers without authorization. The `DeleteCollection` Kubernetes verb was not routed through `AuthorizeTierOperation` - the per-tier enforcement gate that governs all other write operations - meaning any principal holding `deletecollection` or wildcard verbs on tier-scoped policy resources could silently collapse network enforcement boundaries in tiers they have no legitimate access to. No public exploit or CISA KEV listing exists at time of analysis; four upstream patches have been merged and a vendor advisory (TTA-2026-006) has been published.
Authorization bypass in Tigera Calico, Calico Enterprise, and Calico Cloud allows network-adjacent attackers with no special RBAC to reach HTTP endpoints that Application Layer Policy was configured to restrict. Because Dikastes matched raw request paths without RFC 3986/7230 normalization, requests using path-traversal segments, percent-encoded or backslash separators, repeated slashes, or matrix parameters were authorized under a permitted Prefix rule while the downstream workload or fronting proxy normalized them to the restricted endpoint. A vendor fix exists (PRs 12531/12532/12533, advisory TTA-2026-005); no public exploit identified at time of analysis, and the affected Application Layer Policy feature is disabled by default.
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.
Tier authorization bypass in Tigera Calico's apiserver allows an authenticated high-privileged user to bulk-delete NetworkPolicy, GlobalNetworkPolicy, and their staged variants across restricted tiers without authorization. The `DeleteCollection` Kubernetes verb was not routed through `AuthorizeTierOperation` - the per-tier enforcement gate that governs all other write operations - meaning any principal holding `deletecollection` or wildcard verbs on tier-scoped policy resources could silently collapse network enforcement boundaries in tiers they have no legitimate access to. No public exploit or CISA KEV listing exists at time of analysis; four upstream patches have been merged and a vendor advisory (TTA-2026-006) has been published.
Authorization bypass in Tigera Calico, Calico Enterprise, and Calico Cloud allows network-adjacent attackers with no special RBAC to reach HTTP endpoints that Application Layer Policy was configured to restrict. Because Dikastes matched raw request paths without RFC 3986/7230 normalization, requests using path-traversal segments, percent-encoded or backslash separators, repeated slashes, or matrix parameters were authorized under a permitted Prefix rule while the downstream workload or fronting proxy normalized them to the restricted endpoint. A vendor fix exists (PRs 12531/12532/12533, advisory TTA-2026-005); no public exploit identified at time of analysis, and the affected Application Layer Policy feature is disabled by default.
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.