projectcalico vulnerabilities

Products

• github.com/projectcalico/calico 6
• github.com/projectcalico/calicoctl/v3 1

Latest projectcalico CVEs

Newest publication first

1. CVE-2026-6720 Calicoctl leaks cluster credentials to stderr when verbose logging is enabled

   Published 2026-05-28

   High·CVSS 7.2 EPSS 0.22%

   When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (wi...

2. CVE-2026-41184 ServiceAccount token disclosure via install-cni container logs

   Published 2026-05-28

   Medium·CVSS 6.0 EPSS 0.50%

   In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the SERVICEACCOUNT_TOKEN placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer toke...

3. CVE-2026-41185 ServiceAccount token disclosure via Azure IPAM CNI plugin logs

   Published 2026-05-28

   Medium·CVSS 6.0 EPSS 0.32%

   When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at...

4. CVE-2024-33522 Privilege escalation in Calico CNI install binary

   Published 2024-04-29

   Medium·CVSS 6.7 EPSS 0.22%

   In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calic...

5. CVE-2023-41378 Calico Typha hangs during unclean TLS handshake

   Published 2023-11-06

   High·CVSS 7.5 EPSS 0.89%

   In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed ins...

6. CVE-2022-28224 Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature

   Published 2022-06-06

   Medium·CVSS 5.5 EPSS 0.62%

   Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if th...

7. CVE-2020-13597 Calico nodes IPv6 traffic redirection from route advertisment

   Published 2020-06-03

   Low·CVSS 3.5 EPSS 0.90%

   Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.