Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Tigera Calico Enterprise 3.21.7, 3.22.4 Clear all filters
TI-2026-29809 CVE-2026-41186 · GHSA-h3h4-j2qv-pv4j

Unauthenticated Go pprof exposure in Calico debug server

Priority LOW 28

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00666 Published 2026-07-30 Fixed in 3.31.6, 3.32.1 +3 CWE-200
TI-2026-05735 CVE-2026-6540 · GHSA-gm75-wg2c-p77x

L7 policy bypass via unnormalized HTTP path matching

Priority LOW 35

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.00539 Published 2026-07-30 Fixed in 3.31.6, 3.21.7 +2 CWE-22