Executive brief
Tigera Calico, a networking and security solution for Kubernetes, contains a vulnerability that allows users with certain permissions to bypass security boundaries. An authorized user who has permission to delete collections of resources can bulk-delete security policies in 'tiers' they are not supposed to access. This could lead to the unexpected removal of critical network security rules, potentially exposing sensitive workloads or causing service disruptions.
Technical details
The vulnerability exists in Calico's apiserver implementation of tier-scoped resources. While individual delete operations are correctly wrapped by the AuthorizeTierOperation check, the Delete override for NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked during DeleteCollection requests. An attacker with 'deletecollection' or wildcard permissions on these resources can perform bulk deletions across tiers they do not have explicit rights to manage. This breaks the tier authorization boundary, leading to a loss of integrity and availability of security policies. The issue is addressed in Calico Open Source v3.31.6 and v3.32.1, Calico Enterprise v3.21.7 and v3.22.5, and Calico Cloud v22.4.0.
Affected products
- Tigera Calico Open Source < 3.31.6, 3.32.0 - 3.32.1
- Tigera Calico Enterprise < 3.21.7, 3.22.0 - 3.22.5
- Tigera Calico Cloud < 22.4.0
Timeline
- 2026-05-11: patched: Fixes merged into Calico repository branches.
- 2026-07-30: advisory: Tigera Security Bulletin TTA-2026-006 published.