Calico vulnerabilities
3 known CVE vulnerabilities in Calico, translated and rated.
- CVE-2026-6540High
A vulnerability in Calico's Application Layer Policy (disabled by default) fails to perform URL path normalization, allowing attackers to bypass Prefix path rules using path-traversal segments, encoded slashes, or repeated slashes, enabling access to restricted HTTP endpoints.
- CVE-2026-41187Medium
A vulnerability in Calico allows a user with the deletecollection verb or wildcard on tier-scoped policy resources to bulk-delete policies in tiers they have no rights on. This occurs because the Delete method for NetworkPolicy, GlobalNetworkPolicy, and their variants is not invoked for DeleteCollection requests, bypassing AuthorizeTierOperation authorization.
- CVE-2026-41186High
A vulnerability in Calico's optional debug server (pprof), when enabled, listens on 0.0.0.0 without authentication. Any pod with network access can read the process heap, goroutine stacks (including function arguments), and command-line arguments, potentially exposing sensitive data.