CVE-2026-41187: Calico Tier Authorization Bypass via DeleteCollection

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-30 · updated 2026-08-08
Weakness: CWE-285

Description

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Affected products

Tigera Calico: before 3.21.7; before 3.31.6; through 22.4.0; from 3.22.0 before 3.22.4; from 3.32.0 before 3.32.1 — fixed in 3.21.7, 3.22.4, 3.31.6, 3.32.1

How to fix

Upgrade to a fixed version: Tigera Calico 3.21.7, 3.22.4, 3.31.6, 3.32.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41187 or the next vulnerability affects your stack