CVE-2026-41187

Summary

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Affected Software

VendorProductVersion RangeStatus
TigeraCalico0 < 3.31.6affected
TigeraCalico3.32.0 < 3.32.1affected
TigeraCalico Enterprise0 < 3.21.7affected
TigeraCalico Enterprise3.22.0 < 3.22.5affected
TigeraCalico Cloud0 < 22.4.0affected

Weaknesses

  • CWE-285: CWE-285 Improper Authorization
  • CWE-863: CWE-863 Incorrect Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References