Auth bypass in Tigera Calico
CVE-2026-41187
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection reques…
Affected products
- Tigera Calico — versions 0, 3.32.0
- Tigera Calico Cloud — versions 0
- Tigera Calico Enterprise — versions 0, 3.22.0
Weakness classification (CWE)
References
- psirt@tigera.io (patch)
- psirt@tigera.io (patch)
- psirt@tigera.io (patch)
- psirt@tigera.io (patch)
- psirt@tigera.io (vendor-advisory)