Read the docs
TI-2026-29810 Aliases CVE-2026-41187GHSA-38w4-qxg9-xg36

Calico Tier Authorization Bypass via DeleteCollection

Priority LOW 28CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Fixed Calico (Tigera): 3.31.6, 3.32.1Calico Enterprise (Tigera): 3.21.7, 3.22.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TigeraCalicobefore 3.31.6; 3.32.0 to before 3.32.13.31.6, 3.32.1Patch availableCNA
TigeraCalico Enterprisebefore 3.21.7; 3.22.0 to before 3.22.53.21.7, 3.22.5Patch availableCNA
TigeraCalico Cloudbefore 22.4.022.4.0Patch availableCNA
  • Calico VendorTigera Affected before 3.31.6; 3.32.0 to before 3.32.1 Fixed in 3.31.6, 3.32.1 Patch available CNA
  • Calico Enterprise VendorTigera Affected before 3.21.7; 3.22.0 to before 3.22.5 Fixed in 3.21.7, 3.22.5 Patch available CNA
  • Calico Cloud VendorTigera Affected before 22.4.0 Fixed in 22.4.0 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*before 3.21.7VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*before 3.31.6VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*up to 22.4.0VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*3.22.0 to before 3.22.4VulnerableTigera
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*3.32.0 to before 3.32.1VulnerableTigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:* Versions before 3.21.7 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* Versions before 3.31.6 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:* Versions up to 22.4.0 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:* Versions 3.22.0 to before 3.22.4 Vulnerable ·Tigera
  • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* Versions 3.32.0 to before 3.32.1 Vulnerable ·Tigera

Remediation

  • Fix · CNA Calico (Tigera) Fixed in 3.31.6, 3.32.1
  • Fix · CNA Calico Enterprise (Tigera) Fixed in 3.21.7, 3.22.5
  • Fix · CNA Calico Cloud (Tigera) Fixed in 22.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tigera Calico Cloud 22.4.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-05735 L7 policy bypass via unnormalized HTTP path matchingPriority LOW 35
    • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug serverPriority LOW 28
    Show all 3 records →
  • Release ·

    Tigera Calico 3.31.6, 3.32.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug serverPriority LOW 28
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41187
  2. 2026-10-03 Alias added: GHSA-38w4-qxg9-xg36

References

Patch 4

Advisory 1

  • TI-2026-05735 L7 policy bypass via unnormalized HTTP path matching CVSS 4.0HIGH 7.9
  • TI-2026-29809 Unauthenticated Go pprof exposure in Calico debug server CVSS 4.0MEDIUM 6.0
  • TI-2026-29808 ServiceAccount token disclosure via Azure IPAM CNI plugin logs CVSS 4.0MEDIUM 6.0
  • TI-2026-29807 ServiceAccount token disclosure via install-cni container logs CVSS 4.0MEDIUM 6.0
  • TI-2022-11010 Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences