Calico Enterprise
Monthly
Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.
Tier authorization bypass in Tigera Calico's apiserver allows an authenticated high-privileged user to bulk-delete NetworkPolicy, GlobalNetworkPolicy, and their staged variants across restricted tiers without authorization. The `DeleteCollection` Kubernetes verb was not routed through `AuthorizeTierOperation` - the per-tier enforcement gate that governs all other write operations - meaning any principal holding `deletecollection` or wildcard verbs on tier-scoped policy resources could silently collapse network enforcement boundaries in tiers they have no legitimate access to. No public exploit or CISA KEV listing exists at time of analysis; four upstream patches have been merged and a vendor advisory (TTA-2026-006) has been published.
Authorization bypass in Tigera Calico, Calico Enterprise, and Calico Cloud allows network-adjacent attackers with no special RBAC to reach HTTP endpoints that Application Layer Policy was configured to restrict. Because Dikastes matched raw request paths without RFC 3986/7230 normalization, requests using path-traversal segments, percent-encoded or backslash separators, repeated slashes, or matrix parameters were authorized under a permitted Prefix rule while the downstream workload or fronting proxy normalized them to the restricted endpoint. A vendor fix exists (PRs 12531/12532/12533, advisory TTA-2026-005); no public exploit identified at time of analysis, and the affected Application Layer Policy feature is disabled by default.
Credential exposure in Tigera Calico's Azure IPAM integration causes ServiceAccount tokens, client keys, and certificate authority data to be written in plaintext to a node-local log file on every pod scheduling and termination event. Affected deployments include Calico, Calico Enterprise, and Calico Cloud when the Azure IPAM plugin is in use with token-based Kubernetes authentication. Any low-privileged principal able to read /var/log/calico/cni/cni.log on an affected node can extract these credentials and leverage them for cluster-wide Calico networking administration. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the sensitive nature of the exposed material - full Kubernetes auth credentials - makes this a meaningful lateral movement and privilege escalation risk within affected Azure-hosted Kubernetes clusters.
Credential disclosure in Tigera Calico's calicoctl CLI exposes cluster-access secrets through verbose logging output. When operators run calicoctl with --log-level=info or --log-level=debug, the tool serializes its entire connection-configuration struct (including bearer tokens, etcd passwords, and inline PEM client certificates/keys) to stderr in a single log line, making them harvestable by anyone with access to CI logs, terminal recordings, or support transcripts. The issue is patched upstream but no public exploit is identified at time of analysis; default panic-level logging means standard deployments are not exposed.
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.
Tier authorization bypass in Tigera Calico's apiserver allows an authenticated high-privileged user to bulk-delete NetworkPolicy, GlobalNetworkPolicy, and their staged variants across restricted tiers without authorization. The `DeleteCollection` Kubernetes verb was not routed through `AuthorizeTierOperation` - the per-tier enforcement gate that governs all other write operations - meaning any principal holding `deletecollection` or wildcard verbs on tier-scoped policy resources could silently collapse network enforcement boundaries in tiers they have no legitimate access to. No public exploit or CISA KEV listing exists at time of analysis; four upstream patches have been merged and a vendor advisory (TTA-2026-006) has been published.
Authorization bypass in Tigera Calico, Calico Enterprise, and Calico Cloud allows network-adjacent attackers with no special RBAC to reach HTTP endpoints that Application Layer Policy was configured to restrict. Because Dikastes matched raw request paths without RFC 3986/7230 normalization, requests using path-traversal segments, percent-encoded or backslash separators, repeated slashes, or matrix parameters were authorized under a permitted Prefix rule while the downstream workload or fronting proxy normalized them to the restricted endpoint. A vendor fix exists (PRs 12531/12532/12533, advisory TTA-2026-005); no public exploit identified at time of analysis, and the affected Application Layer Policy feature is disabled by default.
Credential exposure in Tigera Calico's Azure IPAM integration causes ServiceAccount tokens, client keys, and certificate authority data to be written in plaintext to a node-local log file on every pod scheduling and termination event. Affected deployments include Calico, Calico Enterprise, and Calico Cloud when the Azure IPAM plugin is in use with token-based Kubernetes authentication. Any low-privileged principal able to read /var/log/calico/cni/cni.log on an affected node can extract these credentials and leverage them for cluster-wide Calico networking administration. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the sensitive nature of the exposed material - full Kubernetes auth credentials - makes this a meaningful lateral movement and privilege escalation risk within affected Azure-hosted Kubernetes clusters.
Credential disclosure in Tigera Calico's calicoctl CLI exposes cluster-access secrets through verbose logging output. When operators run calicoctl with --log-level=info or --log-level=debug, the tool serializes its entire connection-configuration struct (including bearer tokens, etcd passwords, and inline PEM client certificates/keys) to stderr in a single log line, making them harvestable by anyone with access to CI logs, terminal recordings, or support transcripts. The issue is patched upstream but no public exploit is identified at time of analysis; default panic-level logging means standard deployments are not exposed.
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.