CVE-2026-6720: Project Calico calicoctl credential disclosure in verbose logs

CVE-2026-6720 · Severity: high · CVSS 4 · Published 2026-05-28

Calico, a networking and security solution for containers and Kubernetes, contains a vulnerability where sensitive credentials may be recorded in log files. When the command-line tool 'calicoctl' is run with high-detail logging enabled, it inadvertently writes full cluster credentials—including passwords and security tokens—to the system's error log. Anyone with access to these logs, such as through shared support tickets, automated build systems, or local file access, could use these credentials to gain unauthorized control over the Kubernetes cluster.

Technologies: Tigera Calico Cloud, Tigera Calico Enterprise. Vendors: Go, Tigera.

Quick answers

Is CVE-2026-6720 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6720 being exploited in the wild.
How severe is CVE-2026-6720?
High severity, with a CVSS score of 4, published 28 May 2026.
Which products and versions are affected?
github.com/projectcalico/calicoctl (Go) SEMVER:introduced=0; github.com/projectcalico/calicoctl/v3 (Go) < 3.31.6, SEMVER:introduced=0, SEMVER:introduced=0,fixed=3.31.6; Project Calico Calicoctl < 3.31.6, < 3.32.0, < 3.33.0; Tigera Calico Cloud < 22.4.0; and 1 more.
Is there a fix for CVE-2026-6720?
Yes. github.com/projectcalico/calicoctl/v3 (Go): upgrade to 3.31.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6720 attacked?
It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-6720?
Check whether you run github.com/projectcalico/calicoctl (Go), github.com/projectcalico/calicoctl/v3 (Go), Project Calico Calicoctl or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/projectcalico/calicoctl/v3 (Go): upgrade to 3.31.6 or later
    go get github.com/projectcalico/calicoctl/v3@v3.31.6

Technical details

A sensitive information disclosure vulnerability (CWE-532) exists in the calicoctl command-line tool. When invoked with --log-level=info or --log-level=debug, the client serializes the entire connection-configuration struct to stderr. This struct contains plaintext credentials including inline kubeconfigs, Kubernetes API bearer tokens, etcd passwords, and PEM-encoded etcd client certificates/keys. An attacker who can read the stderr stream—via CI/CD logs, session recordings, or local filesystem access—can extract these credentials to gain unauthorized access to the cluster. The issue is patched in version 3.31.6 and later.

Affected products

  • Project Calico Calico < 3.31.6
  • Tigera Calico Enterprise < 3.21.7
  • Tigera Calico Cloud < 22.4.0

Identifiers

  • CVE-2026-6720
  • GHSA-3m4q-ggcj-j6m4
  • GO-2026-5893

Timeline

  • 2026-04-20: patched: Fix merged into master branch
  • 2026-05-28: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.