Read the docs
TI-2020-10675 Aliases CVE-2020-13597GHSA-pf59-j7c2-rh6x

Calico nodes IPv6 traffic redirection from route advertisment

Priority LOW 29CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-201.

Summary

Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.

Why it matters now

EPSS 0.00902 59th percentileScored 2026-11-07
Fix Fixed github.com/projectcalico/calico (Go): 3.14.1, 3.13.4, 3.12.2 +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TigeraCalico3.14.0; up to 3.13.3; up to 3.12.1; up to 3.11.2; up to 3.10.3; up to 3.9.5; up to 3.8.8; 3.7.x; 3.6.x; 3.5.x; 3.4.x; 3.3.x; 3.2.x; 3.1.x; 3.0.x; 2.6.x; 2.5.x; 2.4.x; 2.3.x; 2.2.x; 2.1.x; 2.0.x; 1.6.x; 1.5.x—No fix listedCNA
TigeraCalico Enterpriseup to 2.8.2; up to 2.7.4; up to 2.6.2; 2.5.x; 2.4.x; 2.3.x; 2.2.x; 2.1.x; 2.0.x—No fix listedCNA
—github.com/projectcalico/calico (Go)3.14.0 to before 3.14.13.14.1Patch availableGHSA-pf59-j7c2-rh6x
—github.com/projectcalico/calico (Go)3.13.0 to before 3.13.43.13.4Patch availableGHSA-pf59-j7c2-rh6x
—github.com/projectcalico/calico (Go)3.12.0 to before 3.12.23.12.2Patch availableGHSA-pf59-j7c2-rh6x
—github.com/projectcalico/calico (Go)3.11.0 to before 3.11.33.11.3Patch availableGHSA-pf59-j7c2-rh6x
—github.com/projectcalico/calico (Go)3.10.0 to before 3.10.43.10.4Patch availableGHSA-pf59-j7c2-rh6x
—github.com/projectcalico/calico (Go)3.9.0 to before 3.9.63.9.6Patch availableGHSA-pf59-j7c2-rh6x
—github.com/projectcalico/calico (Go)before 3.8.93.8.9Patch availableGHSA-pf59-j7c2-rh6x
  • Calico VendorTigera Affected 3.14.0; up to 3.13.3; up to 3.12.1; up to 3.11.2; up to 3.10.3; up to 3.9.5; up to 3.8.8; 3.7.x; 3.6.x; 3.5.x; 3.4.x; 3.3.x; 3.2.x; 3.1.x; 3.0.x; 2.6.x; 2.5.x; 2.4.x; 2.3.x; 2.2.x; 2.1.x; 2.0.x; 1.6.x; 1.5.x Fixed in — No fix listed CNA
  • Calico Enterprise VendorTigera Affected up to 2.8.2; up to 2.7.4; up to 2.6.2; 2.5.x; 2.4.x; 2.3.x; 2.2.x; 2.1.x; 2.0.x Fixed in — No fix listed CNA
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.14.0 to before 3.14.1 Fixed in 3.14.1 Patch available GHSA-pf59-j7c2-rh6x
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.13.0 to before 3.13.4 Fixed in 3.13.4 Patch available GHSA-pf59-j7c2-rh6x
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.12.0 to before 3.12.2 Fixed in 3.12.2 Patch available GHSA-pf59-j7c2-rh6x
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.11.0 to before 3.11.3 Fixed in 3.11.3 Patch available GHSA-pf59-j7c2-rh6x
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.10.0 to before 3.10.4 Fixed in 3.10.4 Patch available GHSA-pf59-j7c2-rh6x
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.9.0 to before 3.9.6 Fixed in 3.9.6 Patch available GHSA-pf59-j7c2-rh6x
  • github.com/projectcalico/calico (Go) Vendor— Affected before 3.8.9 Fixed in 3.8.9 Patch available GHSA-pf59-j7c2-rh6x

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:projectcalico:calico:*:*:*:*:enterprise:*:*:*up to 2.6.2VulnerableProject Calico
cpe:2.3:a:projectcalico:calico:*:*:*:*:*:*:*:*up to 3.8.8VulnerableProject Calico
cpe:2.3:a:projectcalico:calico:*:*:*:*:enterprise:*:*:*2.7.0 – 2.7.4; 2.8.0 – 2.8.2VulnerableProject Calico
cpe:2.3:a:projectcalico:calico:*:*:*:*:*:*:*:*3.9.0 – 3.9.5; 3.10.0 – 3.10.3; 3.11.0 – 3.11.2; 3.12.0 – 3.12.1; 3.13.0 – 3.13.3VulnerableProject Calico
cpe:2.3:a:projectcalico:calico:3.14.0:*:*:*:*:*:*:*3.14.0VulnerableProject Calico
  • cpe:2.3:a:projectcalico:calico:*:*:*:*:enterprise:*:*:* Versions up to 2.6.2 Vulnerable ·Project Calico
  • cpe:2.3:a:projectcalico:calico:*:*:*:*:*:*:*:* Versions up to 3.8.8 Vulnerable ·Project Calico
  • cpe:2.3:a:projectcalico:calico:*:*:*:*:enterprise:*:*:* Versions 2.7.0 – 2.7.4; 2.8.0 – 2.8.2 Vulnerable ·Project Calico
  • cpe:2.3:a:projectcalico:calico:*:*:*:*:*:*:*:* Versions 3.9.0 – 3.9.5; 3.10.0 – 3.10.3; 3.11.0 – 3.11.2; 3.12.0 – 3.12.1; 3.13.0 – 3.13.3 Vulnerable ·Project Calico
  • cpe:2.3:a:projectcalico:calico:3.14.0:*:*:*:*:*:*:* Versions 3.14.0 Vulnerable ·Project Calico

Remediation

  • Fix · GHSA-pf59-j7c2-rh6x github.com/projectcalico/calico (Go) Fixed in 3.14.1 Advisory →
  • Fix · GHSA-pf59-j7c2-rh6x github.com/projectcalico/calico (Go) Fixed in 3.13.4 Advisory →
  • Fix · GHSA-pf59-j7c2-rh6x github.com/projectcalico/calico (Go) Fixed in 3.12.2 Advisory →
  • Fix · GHSA-pf59-j7c2-rh6x github.com/projectcalico/calico (Go) Fixed in 3.11.3 Advisory →
  • Fix · GHSA-pf59-j7c2-rh6x github.com/projectcalico/calico (Go) Fixed in 3.10.4 Advisory →
  • Fix · GHSA-pf59-j7c2-rh6x github.com/projectcalico/calico (Go) Fixed in 3.9.6 Advisory →
  • Fix · GHSA-pf59-j7c2-rh6x github.com/projectcalico/calico (Go) Fixed in 3.8.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13597
  2. 2026-10-03 Alias added: GHSA-pf59-j7c2-rh6x

References

Advisory 3

Other 6

  • TI-2023-21972 Calico Typha hangs during unclean TLS handshake CVSS 3.1HIGH 7.5
  • TI-2026-05735 L7 policy bypass via unnormalized HTTP path matching CVSS 4.0HIGH 7.9
  • TI-2026-05888 Calicoctl leaks cluster credentials to stderr when verbose logging is enabled CVSS 4.0HIGH 7.2
  • TI-2024-22113 Privilege escalation in Calico CNI install binary CVSS 3.1MEDIUM 6.7
  • TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollection CVSS 4.0MEDIUM 6.2
  • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug server CVSS 4.0MEDIUM 6.0
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences