CVE-2026-41186: Tigera Calico unauthenticated Go pprof exposure in debug server

CVE-2026-41186 · Severity: info · CVSS 6 · Published 2026-07-30

Tigera Calico, a networking and security solution for Kubernetes, contains a vulnerability in its optional debug server. When this debug feature is manually enabled, it exposes sensitive internal process information to any other application within the same cluster without requiring a password. An attacker could use this to steal sensitive data from the system's memory or learn details about how the network security software is configured, potentially leading to further attacks.

Technologies: Tigera Calico Cloud, Tigera Calico Enterprise. Vendors: Tigera.

Quick answers

Is CVE-2026-41186 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41186 being exploited in the wild.
How severe is CVE-2026-41186?
Informational severity, with a CVSS score of 6, published 30 July 2026.
Which products and versions are affected?
Tigera Calico Cloud < 22.4.0; Tigera Calico Enterprise < 3.21.7, 3.22.0 - 3.22.4; Tigera Calico Open Source < 3.31.6, 3.32.0 - 3.32.1.
Is there a fix for CVE-2026-41186?
A patch was published on 2026-04-15: Initial fix submitted to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41186 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-41186?
Check whether you run Tigera Calico Cloud, Tigera Calico Enterprise or Tigera Calico Open Source at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Calico kube-controllers and Goldmane components when the debug profile port (debugProfilePort or PROFILE_PORT) is enabled. The Go pprof debug listener binds to 0.0.0.0 instead of localhost and lacks authentication. An attacker with network reachability from another pod within the cluster can access the /debug/pprof/ endpoints to retrieve process heaps, goroutine stacks, and command-line arguments. This can lead to the exposure of sensitive material residing in memory. The issue has been addressed by changing the default binding to localhost, requiring tools like kubectl port-forward for remote access.

Affected products

  • Tigera Calico Open Source < 3.31.6, 3.32.0 - 3.32.1
  • Tigera Calico Enterprise < 3.21.7, 3.22.0 - 3.22.4
  • Tigera Calico Cloud < 22.4.0

Timeline

  • 2026-04-15: patched: Initial fix submitted to master branch
  • 2026-07-30: disclosed: Security bulletin TTA-2026-004 published
  • 2026-07-30: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.