Read the docs
TI-2026-29809 Aliases CVE-2026-41186GHSA-h3h4-j2qv-pv4j

Unauthenticated Go pprof exposure in Calico debug server

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00666 52nd percentileScored 2026-11-07
Fix Fixed Calico (Tigera): 3.31.6, 3.32.1Calico Enterprise (Tigera): 3.21.7, 3.22.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TigeraCalicobefore 3.31.6; 3.32.0 to before 3.32.13.31.6, 3.32.1Patch availableCNA
TigeraCalico Enterprisebefore 3.21.7; 3.22.0 to before 3.22.43.21.7, 3.22.4Patch availableCNA
TigeraCalico Cloudbefore 22.4.022.4.0Patch availableCNA
  • Calico VendorTigera Affected before 3.31.6; 3.32.0 to before 3.32.1 Fixed in 3.31.6, 3.32.1 Patch available CNA
  • Calico Enterprise VendorTigera Affected before 3.21.7; 3.22.0 to before 3.22.4 Fixed in 3.21.7, 3.22.4 Patch available CNA
  • Calico Cloud VendorTigera Affected before 22.4.0 Fixed in 22.4.0 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*before 3.21.7VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*before 3.31.6VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*up to 22.4.0VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*3.22.0 to before 3.22.4VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*3.32.0 to before 3.32.1VulnerableTigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:* Versions before 3.21.7 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* Versions before 3.31.6 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:* Versions up to 22.4.0 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:* Versions 3.22.0 to before 3.22.4 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* Versions 3.32.0 to before 3.32.1 Vulnerable ·Tigera

Remediation

  • Fix · CNA Calico (Tigera) Fixed in 3.31.6, 3.32.1
  • Fix · CNA Calico Enterprise (Tigera) Fixed in 3.21.7, 3.22.4
  • Fix · CNA Calico Cloud (Tigera) Fixed in 22.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tigera Calico Cloud 22.4.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-05735 L7 policy bypass via unnormalized HTTP path matchingPriority LOW 35
    • TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollectionPriority LOW 28
    Show all 3 records →
  • Release ·

    Tigera Calico 3.31.6, 3.32.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollectionPriority LOW 28
    Show all 2 records →
Show 1 more group
  • Release ·

    Tigera Calico Enterprise 3.21.7, 3.22.4

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-05735 L7 policy bypass via unnormalized HTTP path matchingPriority LOW 35
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41186
  2. 2026-10-03 Alias added: GHSA-h3h4-j2qv-pv4j

References

Patch 3

Advisory 1

  • TI-2026-05735 L7 policy bypass via unnormalized HTTP path matching CVSS 4.0HIGH 7.9
  • TI-2026-29810 Calico Tier Authorization Bypass via DeleteCollection CVSS 4.0MEDIUM 6.2
  • TI-2026-29808 ServiceAccount token disclosure via Azure IPAM CNI plugin logs CVSS 4.0MEDIUM 6.0
  • TI-2026-29807 ServiceAccount token disclosure via install-cni container logs CVSS 4.0MEDIUM 6.0
  • TI-2022-11010 Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences