Is CVE-2026-41184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41184 being exploited in the wild.

How severe is CVE-2026-41184?

Medium severity, with a CVSS score of 6.5, published 28 May 2026.

Which products and versions are affected?

github.com/projectcalico/calico (Go) SEMVER:introduced=0,fixed=1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, SEMVER:introduced=2.0.0,fixed=3.31.6; github.com/projectcalico/calico/v3 (Go) SEMVER:introduced=0; Tigera Calico >= 2.0.0, < 3.31.6; Tigera Calico CNI Plugin < 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f.

Is there a fix for CVE-2026-41184?

Yes. github.com/projectcalico/calico (Go): upgrade to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, 3.31.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41184 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41184?

Check whether you run github.com/projectcalico/calico (Go), github.com/projectcalico/calico/v3 (Go), Tigera Calico or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41184: Project Calico sensitive information disclosure in install-cni logs

Q: Is there a fix for CVE-2026-41184?

Yes. github.com/projectcalico/calico (Go): upgrade to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, 3.31.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41184 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-41184?

Check whether you run github.com/projectcalico/calico (Go), github.com/projectcalico/calico/v3 (Go), Tigera Calico or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41184 · Severity: medium · CVSS 6.5 · Published 2026-05-28

Calico, a networking and security solution for Kubernetes, contains a vulnerability where sensitive security tokens are accidentally written to system logs. An attacker with basic access to view container logs could steal these tokens to gain unauthorized control over other parts of the cluster. This could lead to unauthorized modifications of cluster workloads or further escalation of privileges within the environment.

Technologies: github.com/projectcalico/calico (Go), github.com/projectcalico/calico/v3 (Go), Tigera Calico. Vendors: Go, Tigera.

Quick answers

Is CVE-2026-41184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41184 being exploited in the wild.
How severe is CVE-2026-41184?: Medium severity, with a CVSS score of 6.5, published 28 May 2026.
Which products and versions are affected?: github.com/projectcalico/calico (Go) SEMVER:introduced=0,fixed=1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, SEMVER:introduced=2.0.0,fixed=3.31.6; github.com/projectcalico/calico/v3 (Go) SEMVER:introduced=0; Tigera Calico >= 2.0.0, < 3.31.6; Tigera Calico CNI Plugin < 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f.
Is there a fix for CVE-2026-41184?: Yes. github.com/projectcalico/calico (Go): upgrade to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, 3.31.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41184 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41184?: Check whether you run github.com/projectcalico/calico (Go), github.com/projectcalico/calico/v3 (Go), Tigera Calico or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/projectcalico/calico (Go): upgrade to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, 3.31.6 or later
```
go get github.com/projectcalico/calico@v3.31.6
```

Technical details

A vulnerability in the Calico 'install-cni' init container causes the rendered CNI configuration to be logged to stdout. In Canal or Flannel-Calico deployments using the __SERVICEACCOUNT_TOKEN__ placeholder, the installer substitutes the live Kubernetes ServiceAccount bearer token before logging. This exposes the token to any authenticated user with 'pods/log' permissions in the namespace containing the calico-node. The leaked token possesses 'patch' privileges on 'pods/status', which can be leveraged for annotation-based attacks against cluster workloads. This issue is a regression of a previous vulnerability (TTA-2018-001) and does not affect default kubeconfig-based authentication paths.

Affected products

Tigera Calico >= 2.0.0, < 3.31.6
Tigera Calico CNI Plugin < 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f

Identifiers

CVE-2026-41184
GHSA-9p7w-w5q6-mxj3
GO-2026-5888

Timeline

2026-05-28: disclosed
2026-05-28: advisory
2026-04-17: patched: Fix merged into master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.