Path Traversal in Tigera Calico
CVE-2026-6540
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.004 (30.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Tigera Calico — versions 0
- Tigera Calico Cloud — versions 0
- Tigera Calico Enterprise — versions 0, 3.22.0
Weakness classification (CWE)
References
- psirt@tigera.io (Patch, patch, Issue Tracking)
- psirt@tigera.io (Patch, patch, Issue Tracking)
- psirt@tigera.io (Patch, patch, Issue Tracking)
- psirt@tigera.io (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-6540?
- CVE-2026-6540 is a high-severity vulnerability in Tigera Calico, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-07-30.
- How severe is CVE-2026-6540?
- High severity. CVSS v3 base score is 7.5 out of 10.