« Volver al listado

CVE-2026-41187

Estado: AnalizadaMedia (6.2)—

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tigera — Calico

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41187",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41187",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-30T16:11:20.822241Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@tigera.io",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@tigera.io",
      "affectedData": [
        {
          "vendor": "Tigera",
          "product": "Calico",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.31.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.32.0",
              "lessThan": "3.32.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Tigera",
          "product": "Calico Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.21.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.22.0",
              "lessThan": "3.22.5",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Tigera",
          "product": "Calico Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "22.4.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-30T15:16:31.860",
  "references": [
    {
      "url": "https://github.com/projectcalico/calico/pull/12731",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "psirt@tigera.io"
    },
    {
      "url": "https://github.com/projectcalico/calico/pull/12735",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "psirt@tigera.io"
    },
    {
      "url": "https://github.com/projectcalico/calico/pull/12736",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "psirt@tigera.io"
    },
    {
      "url": "https://github.com/projectcalico/calico/pull/12737",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "psirt@tigera.io"
    },
    {
      "url": "https://www.tigera.io/security-bulletins/tta-2026-006/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@tigera.io"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@tigera.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary."
    }
  ],
  "lastModified": "2026-08-08T01:16:27.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68BC4A3E-A53E-463F-B627-EB21276BE079",
              "versionEndExcluding": "3.21.7"
            },
            {
              "criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DB36B83-2C1A-4D26-8E29-C4BB8D7AEFD2",
              "versionEndExcluding": "3.31.6"
            },
            {
              "criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62C57322-0A64-41C8-8145-E1471107973D",
              "versionEndIncluding": "22.4.0"
            },
            {
              "criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4BE9961-DD19-41BE-8F40-456752DB141A",
              "versionEndExcluding": "3.22.4",
              "versionStartIncluding": "3.22.0"
            },
            {
              "criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE55BC32-7899-4C2A-8EED-A81B36E95077",
              "versionEndExcluding": "3.32.1",
              "versionStartIncluding": "3.32.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@tigera.io"
}