PT-2026-44409 · Tigera · Calico

Anthony Tam + 3 · CVE-2026-41184 · Published 2026-05-28 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Calico (affected versions not specified)

Description The install-cni init container logs the rendered CNI configuration to standard output. In Canal or Flannel-Calico deployments where the configuration template uses the SERVICEACCOUNT TOKEN placeholder, the installer substitutes the live Kubernetes ServiceAccount bearer token before logging. This exposes the token to any authenticated user with pods/log permissions in the namespace containing calico-node. The exposed token possesses patch privileges on pods/status, which can be used to perform annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-41184

GHSA-9P7W-W5Q6-MXJ3

GO-2026-5888

OPENSUSE-SU-2026:21483-1

Affected Products

Calico

References · 1750

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41184.json · Exploit
• https://github.com/projectcalico/calico/pull/12502 · Patch
• https://github.com/projectcalico/calico/pull/12526 · Patch
• https://github.com/projectcalico/calico/pull/12527 · Patch
• https://tigera.io/security-bulletins/tta-2026-001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p7w-w5q6-mxj3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41184 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41184 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/projectcalico/calico · Note
• https://github.com/projectcalico/calico/commit/0ca653db0ae7400ea9fb066daa7f45c902482271 · Note
• https://github.com/projectcalico/calico/commit/cd73bc2cea0f4989772f2deb93909e7cfac927e0 · Note
• https://github.com/projectcalico/calico/commit/da9ea3a13927a35e4022b787d17a005b2157d812 · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note