Executive brief
Tigera Calico, a networking and security solution for containers and Kubernetes, contains a vulnerability where sensitive credentials are leaked into system logs. When used with the Azure IPAM plugin, the system records Kubernetes ServiceAccount tokens and private keys in plaintext within local log files. An attacker with basic access to a compromised node could use these credentials to gain administrative control over the entire cluster's networking, potentially leading to unauthorized data access or service disruption.
Technical details
A sensitive information disclosure vulnerability (CWE-532) exists in the Calico CNI binary when integrated with the Azure IPAM plugin. The CNI binary mutates incoming configuration data to include subnet information and subsequently logs the entire unmarshaled configuration map (stdinData) at the INFO level to /var/log/calico/cni/cni.log. In clusters using token-based Kubernetes authentication, this log entry includes ServiceAccount tokens, client keys, and certificate authorities in plaintext. The logging occurs during every CNI ADD and DEL invocation (pod scheduling or termination). An attacker with low-privileged access sufficient to read local logs can escalate to cluster-wide Calico networking admin privileges. The issue is addressed in Calico versions 3.31.6, 3.32.0, and corresponding Enterprise/Cloud updates.
Affected products
- Tigera Calico >= 2.0.0, < 3.31.6
- Tigera Calico Enterprise < 3.21.7, 3.22.0 to < 3.22.3
- Tigera Calico Cloud < 22.4.0
Timeline
- 2026-04-17: patched: Fix merged into master branch
- 2026-05-28: advisory: Initial disclosure and NVD publication
- 2026-07-02: other: Advisory reviewed and updated by GitHub security team