{"id":"GO-2026-5888","revision":null,"records":[{"revision":"9e236adc414b4af49e4d481c1c5768af","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41184","aliases":[],"title":"ServiceAccount token disclosure via install-cni container logs","description":"In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.","state":0,"publishedAt":"2026-05-28T15:47:42.173+00:00","modifiedAt":"2026-05-28T17:04:36.059+00:00","affected":[{"ecosystem":"Vendor product","name":"cni-plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Tigera\",\n                    \"product\": \"Calico\",\n                    \"packageName\": \"cni-plugin\",\n                    \"versions\": [\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"3.32.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.31.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"affected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L","score":6,"severity":"MEDIUM"}],"references":["https://github.com/projectcalico/calico/pull/12502","https://github.com/projectcalico/calico/pull/12527","https://github.com/projectcalico/calico/pull/12526","https://www.tigera.io/security-bulletins/tta-2026-001/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41184","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41184","identifiers":["CVE-2026-41184"]},"retained":false,"historicalAffected":[]},{"revision":"34dd8160ca194d4e8c3013b8ca2a2833","observedAt":"2026-10-27T10:10:07.342+00:00","statement":{"source":"nvd","id":"CVE-2026-41184","aliases":[],"title":"In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes th…","description":"In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.","state":0,"publishedAt":"2026-05-28T17:16:22.27+00:00","modifiedAt":"2026-10-26T13:10:00.14+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · psirt@tigera.io · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/projectcalico/calico/pull/12502","https://github.com/projectcalico/calico/pull/12526","https://github.com/projectcalico/calico/pull/12527","https://www.tigera.io/security-bulletins/tta-2026-001/"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41184","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-532"],"productCriteria":["cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*","cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*","cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*"],"sourceDates":{"published":"2026-05-28T17:16:22.270","lastModified":"2026-10-26T13:10:00.140"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41184","identifiers":["CVE-2026-41184"]},"retained":false,"historicalAffected":[]},{"revision":"e1366782fa7c4a34b29379efde7ca71f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9p7w-w5q6-mxj3","aliases":["CVE-2026-41184","GO-2026-5888"],"title":"Calico Inserts Sensitive Information into Log File","description":"In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.","state":0,"publishedAt":"2026-05-28T18:30:32+00:00","modifiedAt":"2026-07-07T16:11:05.8259397+00:00","affected":[{"ecosystem":"Go","name":"github.com/projectcalico/calico","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"3.31.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/projectcalico/calico","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-41184","https://github.com/projectcalico/calico/pull/12502","https://github.com/projectcalico/calico/pull/12526","https://github.com/projectcalico/calico/pull/12527","https://github.com/projectcalico/calico/commit/0ca653db0ae7400ea9fb066daa7f45c902482271","https://github.com/projectcalico/calico/commit/cd73bc2cea0f4989772f2deb93909e7cfac927e0","https://github.com/projectcalico/calico/commit/da9ea3a13927a35e4022b787d17a005b2157d812","https://github.com/projectcalico/calico","https://www.tigera.io/security-bulletins/tta-2026-001"],"sourceUrl":"https://github.com/advisories/GHSA-9p7w-w5q6-mxj3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9p7w-w5q6-mxj3","identifiers":["GHSA-9p7w-w5q6-mxj3","CVE-2026-41184","GO-2026-5888"]},"retained":false,"historicalAffected":[]},{"revision":"5bad45ca0d4044a79280d7f68f3cbdee","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5888","aliases":["CVE-2026-41184","GHSA-9p7w-w5q6-mxj3"],"title":"Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico","description":"Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/projectcalico/calico/v3 before v3.31.6.","state":0,"publishedAt":"2026-07-07T15:26:37+00:00","modifiedAt":"2026-07-07T16:01:31.2279785+00:00","affected":[{"ecosystem":"Go","name":"github.com/projectcalico/calico","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/projectcalico/calico/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-9p7w-w5q6-mxj3","https://nvd.nist.gov/vuln/detail/CVE-2026-41184","https://github.com/projectcalico/calico/commit/0ca653db0ae7400ea9fb066daa7f45c902482271","https://github.com/projectcalico/calico/commit/cd73bc2cea0f4989772f2deb93909e7cfac927e0","https://github.com/projectcalico/calico/commit/da9ea3a13927a35e4022b787d17a005b2157d812","https://github.com/projectcalico/calico/pull/12502","https://github.com/projectcalico/calico/pull/12526","https://github.com/projectcalico/calico/pull/12527","https://www.tigera.io/security-bulletins/tta-2026-001"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5888","license":"OSV · upstream source license applies","key":"osv:GO-2026-5888","identifiers":["GO-2026-5888","CVE-2026-41184","GHSA-9p7w-w5q6-mxj3"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T17:47:33.6124923+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T17:47:33.6124923+00:00","lastSuccessAt":"2026-10-27T17:47:33.8177497+00:00","error":null,"lastVerifiedAt":"2026-10-27T17:47:33.8177523+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-1d364ac0cd434b550397ee70228a56931aa833d8a6b261c3e6bc70a57b06a0f6","complete":true,"records":415299,"lastAttemptAt":"2026-10-27T17:44:11.2286896+00:00","lastSuccessAt":"2026-10-27T17:44:09.7084381+00:00","error":null,"lastVerifiedAt":"2026-10-27T17:44:11.2286896+00:00","snapshotPublishedAt":"2026-10-27T17:26:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T17:47:37.4970153+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13497},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T17:47:33.6124923+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T17:47:33.6124923+00:00","lastSuccessAt":"2026-10-27T17:47:33.818584+00:00","error":null,"lastVerifiedAt":"2026-10-27T17:47:33.8185844+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b877d586fc144938aa44089e665cd1e0","complete":true,"records":13434,"lastAttemptAt":"2026-10-27T17:47:34.5117551+00:00","lastSuccessAt":"2026-10-27T16:46:14.705+00:00","error":null,"lastVerifiedAt":"2026-10-27T16:46:14.705+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13497,"expectedIdentifiers":13497},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-439cd5d099ccb2499c5497741843190e65b167cf304db2a157938d3d4847a993","complete":true,"records":9783,"lastAttemptAt":"2026-10-27T17:47:33.2623747+00:00","lastSuccessAt":"2026-10-27T16:45:44.7050411+00:00","error":null,"lastVerifiedAt":"2026-10-27T17:47:33.2623747+00:00","snapshotPublishedAt":"2026-10-27T16:03:45+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T17:44:11.7010721+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T17:44:11.7010721+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-27T17:47:33.5548586+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-27T17:47:33.5548586+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-9879a6cc2cfcef686e74484f528ab0a58581fed33334cc3f63a0864323c73deb","complete":true,"records":230833,"lastAttemptAt":"2026-10-27T17:47:33.1113165+00:00","lastSuccessAt":"2026-10-27T17:47:31.417422+00:00","error":null,"lastVerifiedAt":"2026-10-27T17:47:33.1113165+00:00","snapshotPublishedAt":"2026-10-27T17:33:24+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}