CVE-2026-41184: falha de média gravidade em Tigera Calico
ServiceAccount token disclosure via install-cni container logs
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6epss 0.5%
In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L
Produtos afetados
Tigera · CalicoCVEs relacionadas — Tigera Calico
No mesmo produto, das mais perigosas para as menos.
CVE-2026-41186MEDIUMUnauthenticated Go pprof exposure in Calico debug serverEPSS 0.7%CVE-2026-6540HIGHL7 policy bypass via unnormalized HTTP path matchingEPSS 0.5%CVE-2026-41187MEDIUMCalico Tier Authorization Bypass via DeleteCollectionEPSS 0.4%CVE-2026-41185MEDIUMServiceAccount token disclosure via Azure IPAM CNI plugin logsEPSS 0.3%CVE-2026-6720HIGHCalicoctl leaks cluster credentials to stderr when verbose logging is enabledEPSS 0.2%CVE-2024-33522MEDIUMPrivilege escalation in Calico CNI install binaryEPSS 0.2%