CVE-2026-6540

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41187

Summary: Calico’s apiserver fails to invoke the Delete override for DeleteCollection on tier-scoped policies (NetworkPolicy, GlobalNetworkPolicy and staged variants). This allows a user with deletecollection or wildcard verbs on tier-scoped policy resources to bulk-delete policies in tiers they w...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

EUVD-2026-51155

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-6540

Technical details about CVE-2026-6540 are not publicly available in the provided documents. Monitor for updated advisories for affected products, impact scope, and remediation guidance.

CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-41186

CVE-2026-41186 affects Calico components (kube-controllers and Goldmane) where an opt-in Go pprof debug listener, if enabled, binds to 0.0.0.0 and allows unauthenticated access. This exposes the process heap, goroutine stacks (including function arguments), and command-line arguments to any pod w...

EUVD-2026-51154

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CLEANSTART-2026-AJ33048 Security fixes in calico 3.30.7-r0

Package calico version 3.30.7-r0 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-AA33691 Security fixes in calico-fips 3.28.5-r4

Package calico-fips version 3.28.5-r4 fixes 5 vulnerabilities: CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2025-13281...

CVE-2026-54332 vulnerabilities

Vulnerabilities for packages: telegraf, cilium-fips, calico-fips, cilium, calico, fq...

GHSA-G6V3-7XMC-W563 vulnerabilities

Vulnerabilities for packages: telegraf, cilium-fips, calico-fips, cilium, calico, fq...

GHSA-6R28-9PPF-4HJ5 vulnerabilities

Vulnerabilities for packages: telegraf, cilium-fips, calico-fips, cilium, calico, fq...

CVE-2026-54345 vulnerabilities

Vulnerabilities for packages: telegraf, cilium-fips, calico-fips, cilium, calico, fq...

GHSA-HRXH-6V49-42GF vulnerabilities

Vulnerabilities for packages: kubevirt-cdi-uploadserver, crossplane-provider-aws-devicefarm, crossplane-provider-aws-cloudsearch-fips, velero-plugin-for-gcp-fips, crossplane-provider-aws-docdb, otel-cli, grafana-pyroscope, terraform-provider-kubernetes-fips, crossplane-provider-aws-transfer-fips,...