CVE-2026-41187CWE-285CWE-863broken-access-control

CVE-2026-41187

Medium · published July 30, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-863 · Incorrect Authorization
Published
2026-07-30T19:16Z
Affected products (5)
ProductVersionsFixed in
tigera/calico< 3.21.73.21.7
tigera/calico< 3.31.63.31.6
tigera/calico≤ 22.4.0—
tigera/calico≥ 3.22.0, < 3.22.43.22.4
tigera/calico≥ 3.32.0, < 3.32.13.32.1
References (5)
https://github.com/projectcalico/calico/pull/12731 · [email protected]https://github.com/projectcalico/calico/pull/12735 · [email protected]https://github.com/projectcalico/calico/pull/12736 · [email protected]https://github.com/projectcalico/calico/pull/12737 · [email protected]https://www.tigera.io/security-bulletins/tta-2026-006/ · [email protected]
EPSS history
Timeline
  • 30 JUL 14:45Z
    Calico Tier Authorization Bypass via DeleteCollection
    cvelistv5