Read the docs
TI-2026-05735 Aliases CVE-2026-6540GHSA-gm75-wg2c-p77x

L7 policy bypass via unnormalized HTTP path matching

Priority LOW 35CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Fixed Calico (Tigera): 3.31.6Calico Enterprise (Tigera): 3.21.7, 3.22.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TigeraCalicobefore 3.31.63.31.6Patch availableCNA
TigeraCalico Enterprisebefore 3.21.7; 3.22.0 to before 3.22.43.21.7, 3.22.4Patch availableCNA
TigeraCalico Cloudbefore 22.4.022.4.0Patch availableCNA
  • Calico VendorTigera Affected before 3.31.6 Fixed in 3.31.6 Patch available CNA
  • Calico Enterprise VendorTigera Affected before 3.21.7; 3.22.0 to before 3.22.4 Fixed in 3.21.7, 3.22.4 Patch available CNA
  • Calico Cloud VendorTigera Affected before 22.4.0 Fixed in 22.4.0 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*before 3.21.7VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*before 3.31.6VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*up to 22.4.0VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*3.22.0 to before 3.22.4VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*3.32.0 to before 3.32.1VulnerableTigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:* Versions before 3.21.7 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* Versions before 3.31.6 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:* Versions up to 22.4.0 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:* Versions 3.22.0 to before 3.22.4 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* Versions 3.32.0 to before 3.32.1 Vulnerable ·Tigera

Remediation

  • Fix · CNA Calico (Tigera) Fixed in 3.31.6
  • Fix · CNA Calico Enterprise (Tigera) Fixed in 3.21.7, 3.22.4
  • Fix · CNA Calico Cloud (Tigera) Fixed in 22.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tigera Calico Cloud 22.4.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollectionPriority LOW 28
    • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug serverPriority LOW 28
    Show all 3 records →
  • Release ·

    Tigera Calico Enterprise 3.21.7, 3.22.4

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug serverPriority LOW 28
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6540
  2. 2026-10-03 Alias added: GHSA-gm75-wg2c-p77x

References

Patch 3

Advisory 1

  • TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollection CVSS 4.0MEDIUM 6.2
  • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug server CVSS 4.0MEDIUM 6.0
  • TI-2026-29808 ServiceAccount token disclosure via Azure IPAM CNI plugin logs CVSS 4.0MEDIUM 6.0
  • TI-2026-29807 ServiceAccount token disclosure via install-cni container logs CVSS 4.0MEDIUM 6.0
  • TI-2022-11010 Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences