Tigera Calico vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20266

Newest CVEs

• CVE-2026-41186

  Unauthenticated Go pprof exposure in Calico debug server

  Tigera · Calico

  Medium6.0
• CVE-2026-41187

  Calico Tier Authorization Bypass via DeleteCollection

  Tigera · Calico

  Medium6.2
• CVE-2026-6540

  L7 policy bypass via unnormalized HTTP path matching

  Tigera · Calico

  High7.9
• CVE-2026-41185

  ServiceAccount token disclosure via Azure IPAM CNI plugin logs

  Tigera · Calico

  Medium6.0
• CVE-2026-6720

  Calicoctl leaks cluster credentials to stderr when verbose logging is enabled

  Tigera · Calico

  High7.2
• CVE-2026-41184

  ServiceAccount token disclosure via install-cni container logs

  Tigera · Calico

  Medium6.0
• CVE-2024-33522

  Privilege escalation in Calico CNI install binary

  Tigera · Calico

  Medium6.7