CVE-2026-6540: Tigera Calico path traversal in Application Layer Policy Dikastes component

CVE-2026-6540 · Severity: info · CVSS 7.9 · Published 2026-07-30

Tigera Calico is a networking and security solution for containers and Kubernetes. A vulnerability in its Application Layer Policy component could allow an attacker to bypass security rules intended to restrict access to specific web addresses. By using specially crafted web requests (such as those containing extra slashes or encoded characters), an attacker can trick the security checker into allowing access to restricted data or administrative endpoints.

Technologies: Tigera Calico, Tigera Calico Cloud, Tigera Calico Enterprise. Vendors: Tigera.

Quick answers

Is CVE-2026-6540 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6540 being exploited in the wild.
How severe is CVE-2026-6540?
Informational severity, with a CVSS score of 7.9, published 30 July 2026.
Which products and versions are affected?
Tigera Calico < 3.31.6; Tigera Calico Cloud < 22.4.0; Tigera Calico Enterprise < 3.21.7, 3.22.0 to < 3.22.4.
Is there a fix for CVE-2026-6540?
A patch was published on 2026-04-17: Initial fix submitted to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6540 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-6540?
Check whether you run Tigera Calico, Tigera Calico Cloud or Tigera Calico Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal and normalization vulnerability exists in Calico's Dikastes component when evaluating Application Layer Policy (ALP) rules. The 'matchHTTPPaths' function performs a byte-for-byte comparison of the raw request-target against policy rules without prior normalization. An attacker can use path-traversal segments (../), percent-encoded slashes, or repeated slashes to bypass prefix-based restrictions. While Dikastes may authorize the unnormalized path under a permissive rule, the downstream workload or proxy typically normalizes the path, leading to the exposure of restricted endpoints. The fix introduces RFC 3986/7230 normalization, including percent-decoding and dot-segment resolution, before policy evaluation.

Affected products

  • Tigera Calico < 3.31.6
  • Tigera Calico Enterprise < 3.21.7, 3.22.0 to < 3.22.4
  • Tigera Calico Cloud < 22.4.0

Timeline

  • 2026-04-17: patched: Initial fix submitted to master branch
  • 2026-07-30: disclosed: CVE-2026-6540 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.