PT-2026-44410 · Tigera · Calico+2

Anthony Tam + 3 · Published 2026-05-28 · Updated 2026-06-05 · CVE-2026-41185

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Calico (affected versions not specified)

Description When configured with the Azure IPAM plugin, the Calico CNI binary modifies the incoming CNI configuration to include subnet information before passing it to the IPAM plugin. The Azure IPAM helper then logs the complete unmarshaled configuration map (stdinData) at the INFO level to /var/log/calico/cni/cni.log during every CNI ADD and DEL invocation, which occurs whenever a pod is scheduled or terminated on a node. In clusters using token-based Kubernetes authentication, these logs contain the ServiceAccount token, client key, and certificate authority in plaintext. An attacker or principal with read access to the log file on a node can extract these credentials to obtain cluster-wide Calico networking admin privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-41185

Affected Products

Calico

Calico Cloud

Calico Enterprise

References · 6

• https://github.com/projectcalico/calico/pull/12526 · Patch
• https://github.com/projectcalico/calico/pull/12502 · Patch
• https://github.com/projectcalico/calico/pull/12527 · Patch
• https://tigera.io/security-bulletins/tta-2026-002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41185 · Security Note
• https://t.me/cveNotify/166222 · Telegram Post