CVE-2026-41185: Tigera Calico sensitive information disclosure in Azure IPAM logs

CVE-2026-41185 · Severity: medium · CVSS 6.5 · Published 2026-05-28

Tigera Calico, a networking and security solution for containers and Kubernetes, contains a vulnerability where sensitive credentials are leaked into system logs. When used with the Azure IPAM plugin, the system records Kubernetes ServiceAccount tokens and private keys in plaintext within local log files. An attacker with basic access to a compromised node could use these credentials to gain administrative control over the entire cluster's networking, potentially leading to unauthorized data access or service disruption.

Technologies: github.com/projectcalico/calico (Go), github.com/projectcalico/calico/v3 (Go), Tigera Calico, Tigera Calico Cloud, Tigera Calico Enterprise. Vendors: Go, Tigera.

Quick answers

Is CVE-2026-41185 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41185 being exploited in the wild.
How severe is CVE-2026-41185?
Medium severity, with a CVSS score of 6.5, published 28 May 2026.
Which products and versions are affected?
github.com/projectcalico/calico (Go) SEMVER:introduced=0,fixed=1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, SEMVER:introduced=2.0.0,fixed=3.31.6; github.com/projectcalico/calico/v3 (Go) SEMVER:introduced=0; Tigera Calico >= 2.0.0, < 3.31.6, v3.31.0 - v3.31.5, v3.32.0, v3.33.0 (pre-patch); Tigera Calico Cloud < 22.4.0; and 1 more.
Is there a fix for CVE-2026-41185?
Yes. github.com/projectcalico/calico (Go): upgrade to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, 3.31.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41185 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41185?
Check whether you run github.com/projectcalico/calico (Go), github.com/projectcalico/calico/v3 (Go), Tigera Calico or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/projectcalico/calico (Go): upgrade to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f, 3.31.6 or later
    go get github.com/projectcalico/calico@v3.31.6

Technical details

A sensitive information disclosure vulnerability (CWE-532) exists in the Calico CNI binary when integrated with the Azure IPAM plugin. The CNI binary mutates incoming configuration data to include subnet information and subsequently logs the entire unmarshaled configuration map (stdinData) at the INFO level to /var/log/calico/cni/cni.log. In clusters using token-based Kubernetes authentication, this log entry includes ServiceAccount tokens, client keys, and certificate authorities in plaintext. The logging occurs during every CNI ADD and DEL invocation (pod scheduling or termination). An attacker with low-privileged access sufficient to read local logs can escalate to cluster-wide Calico networking admin privileges. The issue is addressed in Calico versions 3.31.6, 3.32.0, and corresponding Enterprise/Cloud updates.

Affected products

  • Tigera Calico >= 2.0.0, < 3.31.6
  • Tigera Calico Enterprise < 3.21.7, 3.22.0 to < 3.22.3
  • Tigera Calico Cloud < 22.4.0

Identifiers

  • CVE-2026-41185
  • GHSA-m67g-87rx-v42c
  • GO-2026-5891

Timeline

  • 2026-04-17: patched: Fix merged into master branch
  • 2026-05-28: advisory: Initial disclosure and NVD publication
  • 2026-07-02: other: Advisory reviewed and updated by GitHub security team

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.