CVE-2026-6540

Katalog CVE

CVSS 7.5 · High EPSS 0,54%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada tigera calico. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

8 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tigera.io/security-bulletins/tta-2026-005/ advisory vendor
• https://github.com/projectcalico/calico/pull/12531 issue tracking · patch
• https://github.com/projectcalico/calico/pull/12532 issue tracking · patch
• https://github.com/projectcalico/calico/pull/12533 issue tracking · patch