7.9

CVE-2026-6540

L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tigera ≫ Calico SwEditionenterprise Version < 3.21.7
Tigera ≫ Calico SwEditionopen_source Version < 3.31.6
Tigera ≫ Calico SwEditioncloud Version <= 22.4.0
Tigera ≫ Calico SwEditionenterprise Version >= 3.22.0 < 3.22.4
Tigera ≫ Calico SwEditionopen_source Version >= 3.32.0 < 3.32.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.294
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
psirt@tigera.io 7.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CWE-23 Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

https://github.com/projectcalico/calico/pull/12531
Patch
Issue Tracking
https://github.com/projectcalico/calico/pull/12532
Patch
Issue Tracking
https://github.com/projectcalico/calico/pull/12533
Patch
Issue Tracking
https://www.tigera.io/security-bulletins/tta-2026-005/
Vendor Advisory