Skip to content
OpenAdvisories

Package · Go

github.com/projectcalico/calico

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 6.0
    CVE-2026-41184

    ServiceAccount token disclosure via install-cni container logs

    In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes S…

    Tigera Calico github.com/projectcalico/calico github.com/projectcalico/calico/v3 Go
  • Medium 6.0
    CVE-2026-41185

    ServiceAccount token disclosure via Azure IPAM CNI plugin logs

    When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configurati…

    Tigera Calico Enterprise Calico Calico Cloud Go
  • Medium 6.7
    CVE-2024-33522

    Privilege escalation in Calico CNI install binary

    In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulne…

    Tigera Calico Enterprise Calico Calico Cloud Go
  • High 7.5
    CVE-2023-41378

    Calico Typha hangs during unclean TLS handshake

    In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() …

    Tigera Calico Typha Typha Go
  • Medium 5.5
    CVE-2022-28224

    Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature

    Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotatio…

    Tigera Project Calico Calico Enterprise Calico Go
  • Medium 6.0
    CVE-2020-13597

    Calico nodes IPv6 traffic redirection from route advertisment

    Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interf…

    Tigera Calico Calico Enterprise github.com/projectcalico/calico Go