CVE-2020-13597: Information Disclosure and Sensitive Data Insertion in Calico
Summary
CVE-2020-13597: Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. Affects github.com/projectcalico/calico across 7 version ranges.
< 3.8.9
>= 3.9.0, < 3.9.6
>= 3.10.0, < 3.10.4
>= 3.11.0, < 3.11.3
>= 3.12.0, < 3.12.2
>= 3.13.0, < 3.13.4
>= 3.14.0, < 3.14.1
Fixed in 7 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Calico is an open-source networking and network security solution for containers, virtual machines, and native host-based workloads. It provides secure network connectivity and policy enforcement for cloud-native applications. Calico supports both IPv4 and IPv6 protocols. However, versions 3.14.0 and below of Calico and versions 2.8.2 and below of Calico Enterprise may be vulnerable to information disclosure if IPv6 is enabled but unused. This vulnerability allows a compromised pod with sufficient privilege to reconfigure the node's IPv6 interface, leading to the redirection of network traffic from the node to the compromised pod.
Vulnerability Detail
The vulnerability arises from the node accepting route advertisement by default, enabling an attacker to redirect full or partial network traffic from the node to the compromised pod. This can result in exposure of sensitive information to an unauthorized actor and the insertion of sensitive information into sent data. The impact of this vulnerability can be significant, as it allows an attacker to intercept and manipulate network traffic, potentially leading to data breaches, unauthorized access, and other malicious activities.
How To Fix
Latest published version: v3.21.1+incompatible as of 23 Oct 2026
go get github.com/projectcalico/calico@v3.21.1+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.8.93.8.9go get github.com/projectcalico/calico@v3.8.9 -
>= 3.9.0, < 3.9.63.9.6go get github.com/projectcalico/calico@v3.9.6 -
>= 3.10.0, < 3.10.43.10.4go get github.com/projectcalico/calico@v3.10.4 -
>= 3.11.0, < 3.11.33.11.3go get github.com/projectcalico/calico@v3.11.3 -
>= 3.12.0, < 3.12.23.12.2go get github.com/projectcalico/calico@v3.12.2 -
>= 3.13.0, < 3.13.43.13.4go get github.com/projectcalico/calico@v3.13.4
Show all 7 release lines
-
>= 3.14.0, < 3.14.13.14.1go get github.com/projectcalico/calico@v3.14.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Calico is not immediately feasible, a temporary workaround is to disable IPv6 on the affected nodes. This can be achieved by modifying the node's network configuration to prevent the use of IPv6. However, this workaround may impact any legitimate use of IPv6 within the cluster and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
The vulnerability in Calico and Calico Enterprise versions 3.14.0 and below can lead to the exposure of sensitive information and the insertion of sensitive data into sent data. It is crucial to upgrade to Calico version 0.8.6 or later to mitigate this vulnerability. If immediate upgrade is not possible, disabling IPv6 on the affected nodes can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/projectcalico/calico →
FAQ
Versions 3.14.0 and below of Calico and versions 2.8.2 and below of Calico Enterprise are vulnerable to this issue.
An attacker with sufficient privilege can compromise a pod and reconfigure the node's IPv6 interface. By redirecting network traffic from the node to the compromised pod, the attacker can intercept and manipulate the traffic, potentially gaining unauthorized access to sensitive information.
The vulnerability can lead to exposure of sensitive information to unauthorized actors and the insertion of sensitive information into sent data. This can result in data breaches, unauthorized access, and other malicious activities.
Yes, upgrading to Calico version 0.8.6 or later fixes this vulnerability by preventing the node from accepting route advertisement by default.
A temporary workaround is to disable IPv6 on the affected nodes. However, this should only be considered as a temporary measure until the upgrade to the latest version of Calico can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/projectcalico/calico.
