CVE-2026-6540 Tigera CVE debrief

Who should care

Calico users, administrators, and security teams should be aware of this vulnerability and take necessary actions to protect their environments. This includes reviewing and updating Calico's Application Layer Policy configurations, monitoring for suspicious HTTP requests, and verifying URL path normalization in downstream workloads and fronting proxies. Additionally, operators and platform administrators should assess the potential impact on their systems and prioritize patching or mitigations accordingly. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory and security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also consider implementing monitoring and detection measures to identify potential exploitation attempts. Security teams should also consider implementing rollback and change windows for remediation efforts. Security teams should also consider implementing source tracking to monitor for potential exploitation attempts. Security teams should also consider implementing asset inventory management to identify potentially affected systems. Security teams should also consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also consider implementing monitoring and detection measures to identify potential exploitation attempts. Security teams should also consider implementing rollback and change windows for remediation efforts. Security teams should also consider implementing source tracking to monitor for potential exploitation attempts. Security teams should also consider implementing asset inventory management to identify potentially affected systems. Security teams should also consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also consider implementing monitoring and detection measures to identify potential exploitation attempts. Security teams should also consider implementing rollback and change windows

Technical summary

Calico's Application Layer Policy, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. This allows HTTP requests using path-traversal segments, encoded slashes, or repeated slashes to potentially reach restricted endpoints. An attacker with network access and no special RBAC can exploit this vulnerability. The vulnerability can be mitigated by applying patches from Tigera as referenced in the CVE record, reviewing and updating Calico's Application Layer Policy configurations, and verifying URL path normalization in downstream workloads and fronting proxies.

Defensive priority

Calico users should prioritize patching to prevent potential path-traversal attacks.

Recommended defensive actions

• Apply patches from Tigera as referenced in the CVE record
• Review and update Calico's Application Layer Policy configurations
• Monitor for suspicious HTTP requests
• Verify URL path normalization in downstream workloads and fronting proxies
• Consider compensating controls for network access

Evidence notes

The CVE description indicates that Calico's Application Layer Policy fails to perform URL path normalization, potentially allowing attackers to reach restricted HTTP endpoints. The NVD entry is currently Analyzed. Further review of the official CVE record and vendor advisories is recommended to understand the full scope of affected systems and potential mitigations. Defenders should verify URL path normalization in downstream workloads and fronting proxies, and monitor for suspicious HTTP requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.