Description
When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tigera | Calico | < 3.32.0 | 3.32.0 |
| Tigera | Calico Enterprise | < 3.21.7 | 3.21.7 |
| Tigera | Calico Cloud | < 22.4.0 | 22.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/projectcalico/calicoctl | all versions | — | GO-2026-5893 |
| Go | github.com/projectcalico/calicoctl/v3 | < 3.31.6 | 3.31.6 | GHSA-3m4q-ggcj-j6m4 |
| Go | github.com/projectcalico/calicoctl/v3 | all versions | — | GO-2026-5893 |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026