Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-6720— Calicoctl leaks cluster credentials to stderr when verbose logging is enabled

Quick assessment

Affected
Tigera Calico
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tigera Calico是美国Tigera公司的一套针对容器、虚拟机和主机工作负载的开源网络安全解决方案。 Tigera Calico存在安全漏洞，该漏洞源于以info或debug日志级别调用时打印完整连接配置结构，可能导致凭据泄露。

AI Predicted 8.2 Difficulty: Easy EPSS 0.22% · P13

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 4

VendorProduct Version RangeStatus
Tigera Calico < 3.32.0 affected
Tigera Calico Cloud < 22.4.0 affected
Tigera Calico Enterprise < 3.21.7 affected
3.22.3 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-6720

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Calicoctl leaks cluster credentials to stderr when verbose logging is enabled
Source: CVE Program / CVE List V5
Vulnerability Description
When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Tigera Calico 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tigera Calico是美国Tigera公司的一套针对容器、虚拟机和主机工作负载的开源网络安全解决方案。 Tigera Calico存在安全漏洞，该漏洞源于以info或debug日志级别调用时打印完整连接配置结构，可能导致凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Tigera Calico 0 ~ 3.32.0 -
Tigera Calico Enterprise 0 ~ 3.21.7 -
Tigera Calico Cloud 0 ~ 22.4.0 -

II. Public POCs for CVE-2026-6720

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-6720

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-6720 (3)

Vendor Advisories for CVE-2026-6720 (1)

Same Patch Batch · Tigera · 2026-05-28 · 3 CVEs total

CVE-2026-41185 ServiceAccount token disclosure via Azure IPAM CNI plugin logs
CVE-2026-41184 ServiceAccount token disclosure via install-cni container logs

IV. Related Vulnerabilities

Same product: Calico
Same vendor: Tigera
Same weakness: CWE-532