228 matches found
CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...
CVE-2026-6540
Technical details about CVE-2026-6540 are not publicly available in the provided documents. Monitor for updated advisories for affected products, impact scope, and remediation guidance.
CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
CVE-2026-41186
When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...
CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server
When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...
EUVD-2026-51154
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...
CVE-2026-6540
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
CVE-2026-41186
The CVE-2026-41186 issue affects Calico components (shared debug server used by kube-controllers and Goldmane). When enabled, the Go pprof debug listener binds to 0.0.0.0 and lacks authentication, allowing any pod with network reachability to access internal memory state via the heap, goroutine s...
CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...
CLEANSTART-2026-SU55782 Security fixes in calico-fips 3.28.5-r2
Package calico-fips version 3.28.5-r2 fixes 3 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-6v2p-p543-phr9...
CLEANSTART-2026-PV49283 Security fixes in calico 3.30.7-r1
Package calico version 3.30.7-r1 fixes 17 vulnerabilities: CVE-2026-29181, CVE-2026-39883, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283...
CLEANSTART-2026-DY03272 Security fixes in calico 3.31.5-r1
Package calico version 3.31.5-r1 fixes 19 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827...
CLEANSTART-2026-KF70162 Security fixes in calico-fips 3.29.5-r0
Package calico-fips version 3.29.5-r0 fixes 2 vulnerabilities: ghsa-6v2p-p543-phr9, ghsa-4x4m-3c2p-qppc...
CLEANSTART-2026-XM11339 Security fixes in calico-fips 3.27.5-r0
Package calico-fips version 3.27.5-r0 fixes 4 vulnerabilities: ghsa-v778-237x-gjrc, ghsa-hcg3-q754-cr77, ghsa-qxpb-5wg8-xv66, ghsa-vvgc-356p-c3xw...
CLEANSTART-2026-AA33691 Security fixes in calico-fips 3.28.5-r4
Package calico-fips version 3.28.5-r4 fixes 5 vulnerabilities: CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2025-13281...
CLEANSTART-2026-ND21168 Security fixes in calico 3.30.7-r3
Package calico version 3.30.7-r3 fixes 3 vulnerabilities: CVE-2026-42504, CVE-2026-27145, CVE-2026-42507...
CLEANSTART-2026-NZ79963 Security fixes in calico 3.31.4-r3
Package calico version 3.31.4-r3 fixes 1 vulnerabilities: CVE-2026-42504...
