Authentication Bypass in Calico Kube-Controllers and Goldmane Debug Server
CVE-2026-41186

6MEDIUM

Key Information:

Vendor

Tigera

Status
Calico
Calico Enterprise
Calico Cloud
Vendor
CVE Published:
30 July 2026

What is CVE-2026-41186?

The Calico shared debug server, when enabled, poses a significant security risk as it binds its Go pprof debug listener to all network interfaces (0.0.0.0) without any form of authentication. This configuration allows any pod that can reach the listener to access critical information, including the process heap and goroutine stacks, which may contain sensitive data such as function arguments and command-line arguments. While the debug server is optional, enabling it without proper security measures can lead to unauthorized data access, potentially exposing sensitive operational details about the environment.

Affected Version(s)

Calico 0 < 3.31.6

Calico 3.32.0 < 3.32.1

Calico Cloud 0 < 22.4.0

References

https://github.com/projectcalico/calico/pull/12491
patch
https://github.com/projectcalico/calico/pull/12634
patch
https://github.com/projectcalico/calico/pull/12633
patch

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Behnam Shobiri
Behnam Shobiri
Anthony Tam
Matt Dupre
.