Path Traversal in Tigera Calico

CVE-2026-6540

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes ar…

Vulnerability class: Path Traversal (Directory Traversal)