These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Calico's Application Layer Policy, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. This allows HTTP requests using path-traversal segments, encoded slashes, or repeated slashes to potentially reach restricted endpoints. An attacker with network access and no special RBAC can exploit this vulnerability. The vulnerability can be mitigated by applying patches from Tigera [truncated]
Calico's apiserver wraps tier-scoped resources through AuthorizeTierOperation but fails to invoke the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants for DeleteCollection requests. This oversight enables users with the deletecollection verb or wildcard verbs on tier-scoped policy resources to bulk-delete policies across tiers they are not authorized for, effectively breach [truncated]
CVE-2026-41186 affects Calico's shared debug server. When enabled, it binds to 0.0.0.0 without authentication, allowing pods with network reachability to access process heap, goroutine stacks, and command-line arguments. This could expose sensitive material depending on the process's in-memory state. Calico users should be aware of the potential risks and take necessary precautions.
CVE-2026-6720 is a HIGH-severity information disclosure vulnerability in calicoctl, the command-line tool for Project Calico. When verbose logging is explicitly enabled via `--log-level=info` or `--log-level=debug`, the tool prints its complete connection-configuration struct to stderr. This struct contains all authentication credentials used to communicate with the cluster, including inline kubeconfig wi [truncated]
When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After this mutation, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation—once per pod scheduled or terminated on the node [truncated]
A vulnerability in Calico's install-cni init container causes Kubernetes ServiceAccount bearer tokens to be logged to standard output when the CNI configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder. This affects Canal/Flannel-Calico deployments. The logged token grants patch privileges on pods/status, which can be exploited by any authenticated user with pods/log permission in the calico [truncated]