CVE-2026-41187
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in Calico allows a user with the deletecollection verb or wildcard on tier-scoped policy resources to bulk-delete policies in tiers they have no rights on. This occurs because the Delete method for NetworkPolicy, GlobalNetworkPolicy, and their variants is not invoked for DeleteCollection requests, bypassing AuthorizeTierOperation authorization.
Risk Assessment
The risk is a breach of tier authorization boundaries, potentially leading to unauthorized deletion of network policies and weakening cluster security.
Recommendation
Apply the fix from Calico vendor that ensures proper authorization for DeleteCollection requests.
Other vulnerabilities in Calico
See all- CVE-2026-6540High
A vulnerability in Calico's Application Layer Policy (disabled by default) fails to perform URL path normalization, allowing attackers to bypass Prefix path rules using path-traversal segments, encoded slashes, or repeated slashes, enabling access to restricted HTTP endpoints.
- CVE-2026-41186High
A vulnerability in Calico's optional debug server (pprof), when enabled, listens on 0.0.0.0 without authentication. Any pod with network access can read the process heap, goroutine stacks (including function arguments), and command-line arguments, potentially exposing sensitive data.
Original NVD description (English source)
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.