Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-41186— Unauthenticated Go pprof exposure in Calico debug server

Quick assessment

Affected
Tigera Calico
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tigera Calico是美国Tigera公司开源的一套针对容器、虚拟机和主机工作负载的开源网络安全解决方案。 Tigera calico 3.31.6之前版本和3.32.0版本至3.32.1之前版本存在安全漏洞，该漏洞源于当共享调试服务器启用时，Calico kube-controllers和Goldmane组件将Go pprof调试监听器绑定到0.0.0.0且无需身份验证，导致网络可达的Pod可检索进程堆、goroutine栈和命令行参数，可能泄露敏感信息。

CVSS 6.0 · Medium EPSS 0.67% · P52

Affected Version Matrix 5

VendorProduct Version RangeStatus
Tigera Calico < 3.31.6 affected
3.32.0< 3.32.1 affected
Tigera Calico Cloud < 22.4.0 affected
Tigera Calico Enterprise < 3.21.7 affected
3.22.0< 3.22.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-41186

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unauthenticated Go pprof exposure in Calico debug server
Source: CVE Program / CVE List V5
Vulnerability Description
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
遗留的调试代码
Source: CVE Program / CVE List V5
Vulnerability Title
Tigera calico 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tigera Calico是美国Tigera公司开源的一套针对容器、虚拟机和主机工作负载的开源网络安全解决方案。 Tigera calico 3.31.6之前版本和3.32.0版本至3.32.1之前版本存在安全漏洞，该漏洞源于当共享调试服务器启用时，Calico kube-controllers和Goldmane组件将Go pprof调试监听器绑定到0.0.0.0且无需身份验证，导致网络可达的Pod可检索进程堆、goroutine栈和命令行参数，可能泄露敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Tigera Calico 0 ~ 3.31.6 -
Tigera Calico Enterprise 0 ~ 3.21.7 -
Tigera Calico Cloud 0 ~ 22.4.0 -

II. Public POCs for CVE-2026-41186

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41186

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-41186 (3)

Vendor Advisories for CVE-2026-41186 (1)

Same Patch Batch · Tigera · 2026-07-30 · 3 CVEs total

CVE-2026-6540 7.9 HIGH L7 policy bypass via unnormalized HTTP path matching
CVE-2026-41187 6.2 MEDIUM Calico Tier Authorization Bypass via DeleteCollection

IV. Related Vulnerabilities

Same product: Calico
Same vendor: Tigera
Same weakness: CWE-489