CVE-2022-28224: Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-06 · updated 2026-06-17
Weakness: CWE-200

Description

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

Affected products

Tigera Calico: before 3.20.5; from 3.21.0 before 3.21.5; from 3.22.0 before 3.22.2 — fixed in 3.20.5, 3.21.5, 3.22.2
Tigera Calico Enterprise: before 3.11.4; 3.12.0 — fixed in 3.11.4

How to fix

Upgrade to a fixed version: Tigera Calico 3.20.5, 3.21.5, 3.22.2; Tigera Calico Enterprise 3.11.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-28224 or the next vulnerability affects your stack