CVE-2026-41187: tigera calico

csirt@kutim:~/threat-intel/cve/CVE-2026-41187

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Improper Authorization pada tigera calico. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Rincian

Terbit di NVD: 30 Juli 2026
Terakhir diubah: 8 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-285: Improper Authorization
CWE-863: Incorrect Authorization
EPSS (30 hari): 0,39% peluang dieksploitasi; lebih tinggi dari 31,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tigera	calico	Semua versi sebelum 3.21.7
tigera	calico	Semua versi sebelum 3.31.6
tigera	calico	Semua versi hingga 22.4.0
tigera	calico	Versi 3.22.0 hingga sebelum 3.22.4
tigera	calico	Versi 3.32.0 hingga sebelum 3.32.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.tigera.io/security-bulletins/tta-2026-006/ advisory vendor
https://github.com/projectcalico/calico/pull/12731 issue tracking · patch
https://github.com/projectcalico/calico/pull/12735 issue tracking · patch
https://github.com/projectcalico/calico/pull/12736 issue tracking · patch
https://github.com/projectcalico/calico/pull/12737 issue tracking · patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.