PT-2022-18888 · Calico+1 · Calico+1

Aloys Augustin + 1 · Published 2022-06-06 · Updated 2025-09-30 · CVE-2022-28224

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Calico versions 3.22.1 and below Calico Enterprise versions 3.12.0 and below

Description The issue is related to insufficient validation in the floating IP feature, which may allow a privileged attacker to set a floating IP annotation to a pod even if the feature is not enabled. This could enable the attacker to intercept and reroute traffic to their compromised pod.

Recommendations For Calico versions 3.22.1 and below, consider disabling the floating IP feature until a patch is available. For Calico Enterprise versions 3.12.0 and below, restrict access to the floating IP annotation to minimize the risk of exploitation.

Fix

Information Disclosure

RCE

Weakness Enumeration

CWE-201

CWE-200

CWE-20

Related Identifiers

CVE-2022-28224

GHSA-9394-XFQ9-6QRP

Affected Products

Calico

Calico Enterprise

References · 7

• https://osv.dev/vulnerability/GHSA-9394-xfq9-6qrp · Vendor Advisory
• https://tigera.io/security-bulletins-tta-2022-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28224 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28224 · Vendor Advisory
• https://github.com/projectcalico/calico · Note
• https://t.me/cibsecurity/43876 · Telegram Post
• https://t.me/cveNotify/136978 · Telegram Post