CVE-2026-41186
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in Calico's optional debug server (pprof), when enabled, listens on 0.0.0.0 without authentication. Any pod with network access can read the process heap, goroutine stacks (including function arguments), and command-line arguments, potentially exposing sensitive data.
Risk Assessment
The risk includes leakage of confidential information from process memory, such as keys, tokens, or configuration data, potentially compromising the entire cluster.
Recommendation
Disable the debug server if not needed. If required, configure it to listen only on localhost (127.0.0.1) and implement authentication.
Other vulnerabilities in Calico
See all- CVE-2026-6540High
A vulnerability in Calico's Application Layer Policy (disabled by default) fails to perform URL path normalization, allowing attackers to bypass Prefix path rules using path-traversal segments, encoded slashes, or repeated slashes, enabling access to restricted HTTP endpoints.
- CVE-2026-41187Medium
A vulnerability in Calico allows a user with the deletecollection verb or wildcard on tier-scoped policy resources to bulk-delete policies in tiers they have no rights on. This occurs because the Delete method for NetworkPolicy, GlobalNetworkPolicy, and their variants is not invoked for DeleteCollection requests, bypassing AuthorizeTierOperation authorization.
Original NVD description (English source)
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.