Executive brief
Calico, a networking and security solution for containers and Kubernetes, contains a vulnerability where sensitive credentials may be recorded in log files. When the command-line tool 'calicoctl' is run with high-detail logging enabled, it inadvertently writes full cluster credentials—including passwords and security tokens—to the system's error log. Anyone with access to these logs, such as through shared support tickets, automated build systems, or local file access, could use these credentials to gain unauthorized control over the Kubernetes cluster.
Technical details
A sensitive information disclosure vulnerability (CWE-532) exists in the calicoctl command-line tool. When invoked with --log-level=info or --log-level=debug, the client serializes the entire connection-configuration struct to stderr. This struct contains plaintext credentials including inline kubeconfigs, Kubernetes API bearer tokens, etcd passwords, and PEM-encoded etcd client certificates/keys. An attacker who can read the stderr stream—via CI/CD logs, session recordings, or local filesystem access—can extract these credentials to gain unauthorized access to the cluster. The issue is patched in version 3.31.6 and later.
Affected products
- Project Calico Calico < 3.31.6
- Tigera Calico Enterprise < 3.21.7
- Tigera Calico Cloud < 22.4.0
Timeline
- 2026-04-20: patched: Fix merged into master branch
- 2026-05-28: advisory: GitHub Advisory and NVD entry published