CVE-2026-41184

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41184", "assignerOrgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d", "state": "PUBLISHED", "assignerShortName": "Tigera", "dateReserved": "2026-04-17T17:41:35.905Z", "datePublished": "2026-05-28T15:47:42.173Z", "dateUpdated": "2026-05-28T17:04:36.059Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d", "shortName": "Tigera", "dateUpdated": "2026-05-28T15:47:42.173Z"}, "title": "ServiceAccount token disclosure via install-cni container logs", "datePublic": "2026-05-28T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-532", "description": "CWE-532 Insertion of sensitive information into log file", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-150", "descriptions": [{"lang": "en", "value": "CAPEC-150 Collect Data from Common Resource Locations"}]}], "affected": [{"vendor": "Tigera", "product": "Calico", "packageName": "cni-plugin", "versions": [{"status": "unaffected", "version": "3.32.0", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.31.6", "versionType": "semver"}], "defaultStatus": "affected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:a:tigera:calico:3.32.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "3.31.6"}]}]}], "descriptions": [{"lang": "en", "value": "In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the </span><span>__SERVICEACCOUNT_TOKEN__</span><span> placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with </span><span>pods/log</span><span> permission in the namespace with calico-node. The token holds </span><span>patch</span><span> privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.</span>"}]}], "references": [{"url": "https://github.com/projectcalico/calico/pull/12502", "tags": ["patch"]}, {"url": "https://github.com/projectcalico/calico/pull/12527", "tags": ["patch"]}, {"url": "https://github.com/projectcalico/calico/pull/12526", "tags": ["patch"]}, {"url": "https://www.tigera.io/security-bulletins/tta-2026-001/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "Behnam Shobiri", "type": "finder"}, {"lang": "en", "value": "Behnam Shobiri", "type": "remediation developer"}, {"lang": "en", "value": "Anthony Tam", "type": "remediation reviewer"}, {"lang": "en", "value": "Matt Dupre", "type": "remediation reviewer"}, {"lang": "en", "value": "Casey Davenport", "type": "remediation verifier"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T17:04:29.437633Z", "id": "CVE-2026-41184", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T17:04:36.059Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41184", "assignerOrgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d", "state": "PUBLISHED", "assignerShortName": "Tigera", "dateReserved": "2026-04-17T17:41:35.905Z", "datePublished": "2026-05-28T15:47:42.173Z", "dateUpdated": "2026-05-28T17:04:36.059Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d", "shortName": "Tigera", "dateUpdated": "2026-05-28T15:47:42.173Z"}, "title": "ServiceAccount token disclosure via install-cni container logs", "datePublic": "2026-05-28T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-532", "description": "CWE-532 Insertion of sensitive information into log file", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-150", "descriptions": [{"lang": "en", "value": "CAPEC-150 Collect Data from Common Resource Locations"}]}], "affected": [{"vendor": "Tigera", "product": "Calico", "packageName": "cni-plugin", "versions": [{"status": "unaffected", "version": "3.32.0", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.31.6", "versionType": "semver"}], "defaultStatus": "affected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:a:tigera:calico:3.32.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "3.31.6"}]}]}], "descriptions": [{"lang": "en", "value": "In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the </span><span>__SERVICEACCOUNT_TOKEN__</span><span> placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with </span><span>pods/log</span><span> permission in the namespace with calico-node. The token holds </span><span>patch</span><span> privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.</span>"}]}], "references": [{"url": "https://github.com/projectcalico/calico/pull/12502", "tags": ["patch"]}, {"url": "https://github.com/projectcalico/calico/pull/12527", "tags": ["patch"]}, {"url": "https://github.com/projectcalico/calico/pull/12526", "tags": ["patch"]}, {"url": "https://www.tigera.io/security-bulletins/tta-2026-001/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "Behnam Shobiri", "type": "finder"}, {"lang": "en", "value": "Behnam Shobiri", "type": "remediation developer"}, {"lang": "en", "value": "Anthony Tam", "type": "remediation reviewer"}, {"lang": "en", "value": "Matt Dupre", "type": "remediation reviewer"}, {"lang": "en", "value": "Casey Davenport", "type": "remediation verifier"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41184", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T17:04:29.437633Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T17:04:33.558Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageName": "cni-plugin", "product": "Calico", "vendor": "Tigera", "versions": [{"status": "unaffected", "version": "3.32.0", "versionType": "semver"}, {"lessThan": "3.31.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "psirt@tigera.io"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "68BC4A3E-A53E-463F-B627-EB21276BE079", "versionEndExcluding": "3.21.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*", "matchCriteriaId": "878E68F9-0DAD-465A-875C-AAEC94EB3C72", "versionEndExcluding": "3.32.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*", "matchCriteriaId": "91B89C3B-F20D-403E-9207-39C084B6BCDB", "versionEndExcluding": "22.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "A3C3C22D-0E75-48A1-A1C7-8DD4FE15BF1E", "versionEndExcluding": "3.22.3", "versionStartIncluding": "3.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001."}, {"lang": "es", "value": "En Calico, el contenedor init install-cni registra la configuraci\u00f3n CNI renderizada en la salida est\u00e1ndar. Cuando la plantilla de configuraci\u00f3n utiliza el marcador de posici\u00f3n __SERVICEACCOUNT_TOKEN__ (despliegues de Canal/Flannel-Calico), el instalador sustituye el token portador de ServiceAccount de Kubernetes en vivo antes de registrar, exponiendo el token a cualquier usuario autenticado con permiso pods/log en el espacio de nombres con calico-node. El token tiene privilegios de parche en pods/status, lo que permite ataques basados en anotaciones contra las cargas de trabajo del cl\u00faster. La ruta de autenticaci\u00f3n predeterminada basada en kubeconfig no se ve afectada. Esto es una regresi\u00f3n directa de TTA-2018-001."}], "id": "CVE-2026-41184", "lastModified": "2026-10-26T13:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@tigera.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41184", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T17:04:29.437633Z", "version": "2.0.3"}}]}, "published": "2026-05-28T17:16:22.270", "references": [{"source": "psirt@tigera.io", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/projectcalico/calico/pull/12502"}, {"source": "psirt@tigera.io", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/projectcalico/calico/pull/12526"}, {"source": "psirt@tigera.io", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/projectcalico/calico/pull/12527"}, {"source": "psirt@tigera.io", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.tigera.io/security-bulletins/tta-2026-001/"}], "sourceIdentifier": "psirt@tigera.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "psirt@tigera.io", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.32.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.31.6)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Calico", "source": "cna", "vendor": "Tigera"}, "product": "calico", "vendor": "tigera"}], "created": "2026-05-28T18:30:23.506868+00:00", "updated": "2026-05-28T19:00:16.791073+00:00", "vendors": ["tigera", "tigera$PRODUCT$calico"]}