What’s Vulnerable › Products

Tigera Calico vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Tigera Calico version is affected

Latest Tigera Calico vulnerabilities

• CVE-2026-6540 — L7 policy bypass via unnormalized HTTP path matching (CVSS 7.5)
• CVE-2026-41187 — Calico Tier Authorization Bypass via DeleteCollection (CVSS 6.5)
• CVE-2026-41186 — Unauthenticated Go pprof exposure in Calico debug server (CVSS 7.5)
• CVE-2026-6720 — Calicoctl leaks cluster credentials to stderr when verbose logging is enabled (CVSS 7.2)
• CVE-2026-41185 — ServiceAccount token disclosure via Azure IPAM CNI plugin logs (CVSS 6.5)
• CVE-2026-41184 — ServiceAccount token disclosure via install-cni container logs (CVSS 6.5)
• CVE-2024-33522 — Privilege escalation in Calico CNI install binary (CVSS 6.7)
• CVE-2022-28224 — Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature (CVSS 5.5)