Tigera vulnerabilities
We track 4 vulnerabilities in Tigera products across 5 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 30, 2026.
Latest Tigera vulnerabilities
- 7.5 High severity
Calico: Improper Limitation of a Pathname to a Restricted Directory
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evalu
- 7.5 High severity
Calico: Exposure of Sensitive Information to an Unauthorized Actor
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the pro
- 7.2 High severity
Calico: Insertion of Sensitive Information into Log File
When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — i
- 7.5 High severity
Typha: Improper Handling of Exceptional Conditions
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() c