← Vulnerability feed

Vulnerability record · CVE-2026-6540 · published 30 July 2026

CVE-2026-6540: Tigera calico path traversal vulnerability

Tigera · Calico

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

7.9 CVSS 4.0 High EPSS 0.54% · top 56.9% CWE-22 · Path traversalCWE-23 · Relative path traversal
7.9CVSS 4.0 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
8 Aug 2026Last modified by NVD

Description

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/projectcalico/calico/pull/12531 Issue TrackingPatch
https://github.com/projectcalico/calico/pull/12532 Issue TrackingPatch
https://github.com/projectcalico/calico/pull/12533 Issue TrackingPatch
https://www.tigera.io/security-bulletins/tta-2026-005/ Vendor Advisory

Track CVE-2026-6540 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.2CVE-2026-41187Tigera calico improper authorization vulnerabilityCalico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy,…EPSS 0.39%6.0CVE-2026-41186Tigera calico information exposure vulnerabilityWhen Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug lis…EPSS 0.67%6.0CVE-2026-41184Tigera calico sensitive information in log file vulnerabilityIn Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEA…EPSS 0.53%6.0CVE-2026-41185Tigera calico sensitive information in log file vulnerabilityWhen Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information befor…EPSS 0.34%5.5CVE-2022-28224Tigera calico information exposure vulnerabilityClusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floatin…EPSS 0.59%9.8CVE-2026-93616Checkpoint multi-domain security management path traversal vulnerabilityA directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Managem…KEVEPSS 20%10.0CVE-2026-85706GitLab CE/EE repository commits API path traversal allows unauthenticated file readGitLab CE/EE contains improper path confinement and missing authentication enforcement in the repository commits API, allowing an unauthenticated use…KEVEPSS 91%analysed5.3CVE-2026-66384JFrog Artifactory path traversal in Docker cache pathAn authenticated user can write data outside the intended Docker cache path under specific remote-repository conditions in JFrog Artifactory. The fla…KEVEPSS 0.66%analysed

Source: NIST National Vulnerability Database (record CVE-2026-6540), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.