Vulnerability record · CVE-2026-41187 · published 30 July 2026

CVE-2026-41187: Tigera calico improper authorization vulnerability

Tigera · Calico

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

6.2 CVSS 4.0 Medium EPSS 0.39% · top 69.7% CWE-285 · Improper authorizationCWE-863 · Incorrect authorization

6.2CVSS 4.0 base score

0.39%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References

8 Aug 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Calico Tigera

References

Link	Tags
https://github.com/projectcalico/calico/pull/12731	Issue TrackingPatch
https://github.com/projectcalico/calico/pull/12735	Issue TrackingPatch
https://github.com/projectcalico/calico/pull/12736	Issue TrackingPatch
https://github.com/projectcalico/calico/pull/12737	Issue TrackingPatch
https://www.tigera.io/security-bulletins/tta-2026-006/	Vendor Advisory

Track CVE-2026-41187 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.9CVE-2026-6540Tigera calico path traversal vulnerabilityCalico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a re…EPSS 0.54%30 Jul 2026 6.0CVE-2026-41186Tigera calico information exposure vulnerabilityWhen Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug lis…EPSS 0.67%30 Jul 2026 6.0CVE-2026-41184Tigera calico sensitive information in log file vulnerabilityIn Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEA…EPSS 0.53%28 May 2026 6.0CVE-2026-41185Tigera calico sensitive information in log file vulnerabilityWhen Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information befor…EPSS 0.34%28 May 2026 5.5CVE-2022-28224Tigera calico information exposure vulnerabilityClusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floatin…EPSS 0.59%6 Jun 2022 8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed15 Sep 2026 9.8CVE-2021-28799QNAP HBS 3 improper authorization allows remote loginQNAP Hybrid Backup Sync 3 (HBS 3) contains an improper authorization flaw that lets remote attackers log in to the NAS device. The issue affects mult…KEVEPSS 78%analysed13 May 2021

Source: NIST National Vulnerability Database (record CVE-2026-41187), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.