TI-2024-22113 Aliases CVE-2024-33522 GHSA-6362-gv4m-53ww

Privilege escalation in Calico CNI install binary

LOW 31CWE-269Published 2024-04-29 · Updated 2024-08-02

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. The issue arises from an incorrect SUID (Set User ID) bit configuration in the binary, combined with the ability to control the input binary, allowing an attacker to execute an arbitrary binary with elevated privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0022 12th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Calico (Tigera): v3.26.5, v3.27.3, v3.28.0Calico Enterprise (Tigera): v3.17.4, v3.18.2, v3.19.0-2.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Tigera	Calico	before v3.26.5; v3.27.0 to before v3.27.3	v3.26.5, v3.27.3, v3.28.0	Patch available	CNA
Tigera	Calico Enterprise	before v3.17.4; v3.18.0 to before v3.18.2; v3.19.0-1.0 to before v3.19.0-2.0	v3.17.4, v3.18.2, v3.19.0-2.0	Patch available	CNA
Tigera	Calico Cloud	before v19.3.0	v19.3.0	Patch available	CNA
—	github.com/projectcalico/calico (Go)	before 3.26.5	3.26.5	Patch available	GHSA-6362-gv4m-53ww
—	github.com/projectcalico/calico (Go)	3.27.0 to before 3.27.3	3.27.3	Patch available	GHSA-6362-gv4m-53ww

Calico VendorTigera Affected before v3.26.5; v3.27.0 to before v3.27.3 Fixed in v3.26.5, v3.27.3, v3.28.0 Patch available CNA
Calico Enterprise VendorTigera Affected before v3.17.4; v3.18.0 to before v3.18.2; v3.19.0-1.0 to before v3.19.0-2.0 Fixed in v3.17.4, v3.18.2, v3.19.0-2.0 Patch available CNA
Calico Cloud VendorTigera Affected before v19.3.0 Fixed in v19.3.0 Patch available CNA
github.com/projectcalico/calico (Go) Vendor— Affected before 3.26.5 Fixed in 3.26.5 Patch available GHSA-6362-gv4m-53ww
github.com/projectcalico/calico (Go) Vendor— Affected 3.27.0 to before 3.27.3 Fixed in 3.27.3 Patch available GHSA-6362-gv4m-53ww

CPE names CISA-ADP · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:tigera:calico::::::::	—	—	Tigera
cpe:2.3:a:tigera:calico_enterprise::::::::	—	—	Tigera
cpe:2.3:a:tigera:calico_cloud::::::::	—	—	Tigera

cpe:2.3:a:tigera:calico:*:*:*:*:*:*:*:* Versions — — ·Tigera
cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:* Versions — — ·Tigera
cpe:2.3:a:tigera:calico_cloud:*:*:*:*:*:*:*:* Versions — — ·Tigera

Remediation

Fix · CNA Calico (Tigera) Fixed in v3.26.5, v3.27.3, v3.28.0
Fix · CNA Calico Enterprise (Tigera) Fixed in v3.17.4, v3.18.2, v3.19.0-2.0
Fix · CNA Calico Cloud (Tigera) Fixed in v19.3.0
Fix · GHSA-6362-gv4m-53ww github.com/projectcalico/calico (Go) Fixed in 3.26.5 Advisory →
Fix · GHSA-6362-gv4m-53ww github.com/projectcalico/calico (Go) Fixed in 3.27.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-33522
2026-10-03 Alias added: GHSA-6362-gv4m-53ww

References

Exploit 1

https://github.com/projectcalico/calico/issues/7981

Patch 2

Advisory 3

Other 3

TI-2023-21972 Calico Typha hangs during unclean TLS handshake CVSS 3.1HIGH 7.5
TI-2026-05735 L7 policy bypass via unnormalized HTTP path matching CVSS 4.0HIGH 7.9
TI-2026-05888 Calicoctl leaks cluster credentials to stderr when verbose logging is enabled CVSS 4.0HIGH 7.2
TI-2020-10675 Calico nodes IPv6 traffic redirection from route advertisment CVSS 3.1MEDIUM 6.0
TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollection CVSS 4.0MEDIUM 6.2
TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug server CVSS 4.0MEDIUM 6.0

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences