CVE-2026-41187: Tigera Calico authorization bypass in tier-scoped DeleteCollection operations

CVE-2026-41187 · Severity: info · CVSS 6.2 · Published 2026-07-30

Tigera Calico, a networking and security solution for Kubernetes, contains a vulnerability that allows users with certain permissions to bypass security boundaries. An authorized user who has permission to delete collections of resources can bulk-delete security policies in 'tiers' they are not supposed to access. This could lead to the unexpected removal of critical network security rules, potentially exposing sensitive workloads or causing service disruptions.

Technologies: Tigera Calico Cloud, Tigera Calico Enterprise. Vendors: Tigera.

Quick answers

Is CVE-2026-41187 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41187 being exploited in the wild.
How severe is CVE-2026-41187?
Informational severity, with a CVSS score of 6.2, published 30 July 2026.
Which products and versions are affected?
Tigera Calico Cloud < 22.4.0; Tigera Calico Enterprise < 3.21.7, 3.22.0 - 3.22.5; Tigera Calico Open Source < 3.31.6, 3.32.0 - 3.32.1.
Is there a fix for CVE-2026-41187?
A patch was published on 2026-05-11: Fixes merged into Calico repository branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41187 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41187?
Check whether you run Tigera Calico Cloud, Tigera Calico Enterprise or Tigera Calico Open Source at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Calico's apiserver implementation of tier-scoped resources. While individual delete operations are correctly wrapped by the AuthorizeTierOperation check, the Delete override for NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked during DeleteCollection requests. An attacker with 'deletecollection' or wildcard permissions on these resources can perform bulk deletions across tiers they do not have explicit rights to manage. This breaks the tier authorization boundary, leading to a loss of integrity and availability of security policies. The issue is addressed in Calico Open Source v3.31.6 and v3.32.1, Calico Enterprise v3.21.7 and v3.22.5, and Calico Cloud v22.4.0.

Affected products

  • Tigera Calico Open Source < 3.31.6, 3.32.0 - 3.32.1
  • Tigera Calico Enterprise < 3.21.7, 3.22.0 - 3.22.5
  • Tigera Calico Cloud < 22.4.0

Timeline

  • 2026-05-11: patched: Fixes merged into Calico repository branches.
  • 2026-07-30: advisory: Tigera Security Bulletin TTA-2026-006 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.