Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Tigera Calico Cloud 22.4.0 Clear all filters
TI-2026-29809 CVE-2026-41186 · GHSA-h3h4-j2qv-pv4j

Unauthenticated Go pprof exposure in Calico debug server

Priority LOW 28

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00666 Published 2026-07-30 Fixed in 3.31.6, 3.32.1 +3 CWE-200
TI-2026-29810 CVE-2026-41187 · GHSA-38w4-qxg9-xg36

Calico Tier Authorization Bypass via DeleteCollection

Priority LOW 28

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for Dele…

CVSS 4.0MEDIUM 6.2 Network High privileges No interaction EPSS 0.00388 Published 2026-07-30 Fixed in 3.31.6, 3.32.1 +3 CWE-285
TI-2026-05735 CVE-2026-6540 · GHSA-gm75-wg2c-p77x

L7 policy bypass via unnormalized HTTP path matching

Priority LOW 35

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.00539 Published 2026-07-30 Fixed in 3.31.6, 3.21.7 +2 CWE-22