← Vulnerability feed

Vulnerability record · CVE-2026-41185 · published 28 May 2026

CVE-2026-41185: Tigera calico sensitive information in log file vulnerability

Tigera · Calico

When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation — once per pod scheduled or terminated on the node. When the cluster is deployed using token-based Kubernetes authentication, this log entry contains the ServiceAccount token, client key, and certificate authority in plaintext. Any principal with read access to /var/log/calico/cni/cni.log on a node  can read these logs and extract the credentials, which grant cluster-wide Calico networking admin privileges.

6.0 CVSS 4.0 Medium EPSS 0.34% · top 75.5% CWE-532 · Sensitive information in log file
6.0CVSS 4.0 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation — once per pod scheduled or terminated on the node. When the cluster is deployed using token-based Kubernetes authentication, this log entry contains the ServiceAccount token, client key, and certificate authority in plaintext. Any principal with read access to /var/log/calico/cni/cni.log on a node  can read these logs and extract the credentials, which grant cluster-wide Calico networking admin privileges.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/projectcalico/calico/pull/12502 Issue Tracking
https://github.com/projectcalico/calico/pull/12526 Issue TrackingPatch
https://github.com/projectcalico/calico/pull/12527 Issue TrackingPatch
https://www.tigera.io/security-bulletins/tta-2026-002/ Vendor Advisory

Track CVE-2026-41185 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.9CVE-2026-6540Tigera calico path traversal vulnerabilityCalico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a re…EPSS 0.54%6.2CVE-2026-41187Tigera calico improper authorization vulnerabilityCalico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy,…EPSS 0.39%6.0CVE-2026-41186Tigera calico information exposure vulnerabilityWhen Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug lis…EPSS 0.67%6.0CVE-2026-41184Tigera calico sensitive information in log file vulnerabilityIn Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEA…EPSS 0.53%5.5CVE-2022-28224Tigera calico information exposure vulnerabilityClusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floatin…EPSS 0.59%4.6CVE-2025-24984Windows NTFS logs sensitive information, enabling physical-attack disclosureWindows NTFS writes sensitive information into a log file, which an attacker can read to disclose data. The flaw is rated CVSS 3.1 4.6 (Medium) and a…KEVEPSS 2.0%analysed4.4CVE-2023-21492Samsung Android kernel pointer logging enables ASLR bypassSamsung Android devices log kernel pointers to a log file before the SMR May-2023 Release 1 fix. A privileged local attacker who can read those logs …KEVEPSS 2.6%analysed

Source: NIST National Vulnerability Database (record CVE-2026-41185), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.