Skip to content
OpenAdvisories

Package · Go

github.com/projectcalico/calico/v3

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.0
    CVE-2026-41184

    ServiceAccount token disclosure via install-cni container logs

    In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes S…

    Tigera Calico github.com/projectcalico/calico github.com/projectcalico/calico/v3 Go
  • Medium 6.0
    CVE-2026-41185

    ServiceAccount token disclosure via Azure IPAM CNI plugin logs

    When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configurati…

    Tigera Calico Enterprise Calico Calico Cloud Go
  • Medium 6.7
    CVE-2024-33522

    Privilege escalation in Calico CNI install binary

    In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulne…

    Tigera Calico Enterprise Calico Calico Cloud Go