{"id":"CVE-2026-41184","sourceIdentifier":"psirt@tigera.io","published":"2026-05-28T17:16:22.270","lastModified":"2026-10-26T13:10:00.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001."},{"lang":"es","value":"En Calico, el contenedor init install-cni registra la configuración CNI renderizada en la salida estándar. Cuando la plantilla de configuración utiliza el marcador de posición __SERVICEACCOUNT_TOKEN__ (despliegues de Canal/Flannel-Calico), el instalador sustituye el token portador de ServiceAccount de Kubernetes en vivo antes de registrar, exponiendo el token a cualquier usuario autenticado con permiso pods/log en el espacio de nombres con calico-node. El token tiene privilegios de parche en pods/status, lo que permite ataques basados en anotaciones contra las cargas de trabajo del clúster. La ruta de autenticación predeterminada basada en kubeconfig no se ve afectada. Esto es una regresión directa de TTA-2018-001."}],"affected":[{"source":"psirt@tigera.io","affectedData":[{"vendor":"Tigera","product":"Calico","defaultStatus":"affected","packageName":"cni-plugin","versions":[{"version":"3.32.0","versionType":"semver","status":"unaffected"},{"version":"0","lessThan":"3.31.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@tigera.io","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-28T17:04:29.437633Z","id":"CVE-2026-41184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@tigera.io","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*","versionEndExcluding":"3.21.7","matchCriteriaId":"68BC4A3E-A53E-463F-B627-EB21276BE079"},{"vulnerable":true,"criteria":"cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*","versionEndExcluding":"3.32.0","matchCriteriaId":"878E68F9-0DAD-465A-875C-AAEC94EB3C72"},{"vulnerable":true,"criteria":"cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*","versionEndExcluding":"22.4.0","matchCriteriaId":"91B89C3B-F20D-403E-9207-39C084B6BCDB"},{"vulnerable":true,"criteria":"cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"3.22.0","versionEndExcluding":"3.22.3","matchCriteriaId":"A3C3C22D-0E75-48A1-A1C7-8DD4FE15BF1E"}]}]}],"references":[{"url":"https://github.com/projectcalico/calico/pull/12502","source":"psirt@tigera.io","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/projectcalico/calico/pull/12526","source":"psirt@tigera.io","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/projectcalico/calico/pull/12527","source":"psirt@tigera.io","tags":["Issue Tracking","Patch"]},{"url":"https://www.tigera.io/security-bulletins/tta-2026-001/","source":"psirt@tigera.io","tags":["Mitigation","Vendor Advisory"]}]}