Skip to content
OpenAdvisories
High · 7.2 CVE-2026-6720 EUVD-2026-32932GHSA-3m4q-ggcj-j6m4GO-2026-5893

Calicoctl leaks cluster credentials to stderr when verbose logging is enabled

Published May 28, 2026 · Updated May 28, 2026 · Assigned by Tigera

Description

When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.

Affected products

VendorProductAffectedFixed
Tigera Calico < 3.32.0 3.32.0
Tigera Calico Enterprise < 3.21.7 3.21.7
Tigera Calico Cloud < 22.4.0 22.4.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/projectcalico/calicoctl all versions — GO-2026-5893
Go github.com/projectcalico/calicoctl/v3 < 3.31.6 3.31.6 GHSA-3m4q-ggcj-j6m4
Go github.com/projectcalico/calicoctl/v3 all versions — GO-2026-5893

Advisories 1

References