Read the docs
TI-2022-11010 Aliases CVE-2022-28224GHSA-9394-xfq9-6qrp

Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature

Priority LOW 26CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

Why it matters now

EPSS 0.00615 49th percentileScored 2026-11-07
Fix Fixed github.com/projectcalico/calico (Go): 3.22.2, 3.21.5, 3.20.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TigeraCalico Enterpriseup to v3.12.0—No fix listedCNA
Project CalicoCalicoup to v3.22.1—No fix listedCNA
—github.com/projectcalico/calico (Go)3.22.0 to before 3.22.23.22.2Patch availableGHSA-9394-xfq9-6qrp
—github.com/projectcalico/calico (Go)3.21.0 to before 3.21.53.21.5Patch availableGHSA-9394-xfq9-6qrp
—github.com/projectcalico/calico (Go)before 3.20.53.20.5Patch availableGHSA-9394-xfq9-6qrp
  • Calico Enterprise VendorTigera Affected up to v3.12.0 Fixed in — No fix listed CNA
  • Calico VendorProject Calico Affected up to v3.22.1 Fixed in — No fix listed CNA
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.22.0 to before 3.22.2 Fixed in 3.22.2 Patch available GHSA-9394-xfq9-6qrp
  • github.com/projectcalico/calico (Go) Vendor— Affected 3.21.0 to before 3.21.5 Fixed in 3.21.5 Patch available GHSA-9394-xfq9-6qrp
  • github.com/projectcalico/calico (Go) Vendor— Affected before 3.20.5 Fixed in 3.20.5 Patch available GHSA-9394-xfq9-6qrp

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*before 3.20.5; 3.21.0 to before 3.21.5; 3.22.0 to before 3.22.2VulnerableTigera
cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:*before 3.11.4VulnerableTigera
cpe:2.3:a:tigera:calico_enterprise:3.12.0:*:*:*:*:*:*:*3.12.0VulnerableTigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* Versions before 3.20.5; 3.21.0 to before 3.21.5; 3.22.0 to before 3.22.2 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:* Versions before 3.11.4 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico_enterprise:3.12.0:*:*:*:*:*:*:* Versions 3.12.0 Vulnerable ·Tigera

Remediation

  • Fix · GHSA-9394-xfq9-6qrp github.com/projectcalico/calico (Go) Fixed in 3.22.2 Advisory →
  • Fix · GHSA-9394-xfq9-6qrp github.com/projectcalico/calico (Go) Fixed in 3.21.5 Advisory →
  • Fix · GHSA-9394-xfq9-6qrp github.com/projectcalico/calico (Go) Fixed in 3.20.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28224
  2. 2026-10-03 Alias added: GHSA-9394-xfq9-6qrp

References

Advisory 2

Other 2

  • TI-2026-05735 L7 policy bypass via unnormalized HTTP path matching CVSS 4.0HIGH 7.9
  • TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollection CVSS 4.0MEDIUM 6.2
  • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug server CVSS 4.0MEDIUM 6.0
  • TI-2026-29808 ServiceAccount token disclosure via Azure IPAM CNI plugin logs CVSS 4.0MEDIUM 6.0
  • TI-2026-29807 ServiceAccount token disclosure via install-cni container logs CVSS 4.0MEDIUM 6.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences