CVE-2026-6540
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in Calico's Application Layer Policy (disabled by default) fails to perform URL path normalization, allowing attackers to bypass Prefix path rules using path-traversal segments, encoded slashes, or repeated slashes, enabling access to restricted HTTP endpoints.
Risk Assessment
An attacker with network access could reach protected HTTP resources that should be blocked by security policies, potentially leading to data leakage or unauthorized operations.
Recommendation
It is recommended to enable URL path normalization in Dikastes or apply patches provided by Calico vendor.
Other vulnerabilities in Calico
See all- CVE-2026-41187Medium
A vulnerability in Calico allows a user with the deletecollection verb or wildcard on tier-scoped policy resources to bulk-delete policies in tiers they have no rights on. This occurs because the Delete method for NetworkPolicy, GlobalNetworkPolicy, and their variants is not invoked for DeleteCollection requests, bypassing AuthorizeTierOperation authorization.
- CVE-2026-41186High
A vulnerability in Calico's optional debug server (pprof), when enabled, listens on 0.0.0.0 without authentication. Any pod with network access can read the process heap, goroutine stacks (including function arguments), and command-line arguments, potentially exposing sensitive data.
Original NVD description (English source)
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.