Tigera

Latest CVEs · RSS

• CVE-2026-41186 2026-07-30 · CVSS 6.0
  When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.
• CVE-2026-41187 2026-07-30 · CVSS 6.2
  Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetw
• CVE-2026-6540 2026-07-30 · CVSS 7.9
  Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP
• CVE-2026-41185 2026-05-28 · CVSS 6.0
  When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegatin
• CVE-2026-6720 2026-05-28 · CVSS 7.2
  When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stder
• CVE-2026-41184 2026-05-28 · CVSS 6.0
  In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKE
• CVE-2024-33522 2024-04-29 · CVSS 6.7
  In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attack
• CVE-2023-41378 2023-11-06 · CVSS 7.5
  In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake c
• CVE-2022-28224 2022-06-06 · CVSS 5.5
  Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP featur
• CVE-2020-13597 2020-06-03 · CVSS 6.0
  Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled bu