p PatchFirst

CVE-2026-41187

CVE-2026-41187 · Calico Tier Authorization Bypass via DeleteCollection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

CVSS 6.2 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: containers

Affected products and versions

  • calico

    Versions
    • ≥ 0, < 3.31.6: Affected (semver)
    • ≥ 3.32.0, < 3.32.1: Affected (semver)

    Update to 3.31.6; Update to 3.32.1

  • calico enterprise

    Versions
    • ≥ 0, < 3.21.7: Affected (semver)
    • ≥ 3.22.0, < 3.22.5: Affected (semver)

    Update to 3.21.7; Update to 3.22.5

  • calico cloud

    Versions
    • ≥ 0, < 22.4.0: Affected (semver)

    Update to 22.4.0

Original sources

Check your server →