PT-2026-44417 · Tigera · Calicoctl

Anthony Tam + 1 · Published 2026-05-28 · Updated 2026-07-07 · CVE-2026-6720

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions calicoctl (affected versions not specified)

Description When the client is invoked with --log-level=info or --log-level=debug, it prints the full contents of its loaded connection-configuration struct to stderr in a single log line. This struct contains sensitive credentials used to communicate with the cluster, including the inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. This allows any reader of the stderr stream, such as CI job logs or session-recording archives, to extract these credentials without requiring Kubernetes privileges. This issue only occurs when verbose logging is explicitly enabled, as the default log level is panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-6720

GHSA-3M4Q-GGCJ-J6M4

GO-2026-5893

Affected Products

Calicoctl

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6720.json · Exploit
• https://github.com/projectcalico/calico/pull/12537 · Patch
• https://github.com/projectcalico/calico/pull/12536 · Patch
• https://github.com/projectcalico/calico/pull/12535 · Patch
• https://osv.dev/vulnerability/CVE-2026-6720 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5893 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3m4q-ggcj-j6m4 · Vendor Advisory
• https://tigera.io/security-bulletins/tta-2026-003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6720 · Security Note
• https://github.com/projectcalico/calico/commit/ce3ab2b39b5841757cbccf7922c895c47827f562 · Note
• https://github.com/projectcalico/calico/commit/8d87eddcb5eb6efc70c09eb0a33d63137359ea70 · Note
• https://github.com/projectcalico/calico · Note
• https://github.com/projectcalico/calico/commit/12908bb48a5bf8cbab5373f4d532509a30cf9b7f · Note
• https://twitter.com/VulmonFeeds/status/2060166569909461247 · Twitter Post
• https://github.com/advisories/GHSA-3m4q-ggcj-j6m4 · Note