CVE-2026-41184: Calico Exposes Kubernetes ServiceAccount Token in Logs

github.com/projectcalico/calico Updated 03 Jul 2026

Summary

28/05/2026

Disclosed on

CVE-2026-41184

CVE

Yes i

Fix available

Moderate

Severity

6.5

CVSS Score

CVE-2026-41184: Calico Inserts Sensitive Information into Log File. Affects github.com/projectcalico/calico across 2 version ranges.

< 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f >= 2.0.0, < 3.31.6

Fixed in 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f or 3.31.6, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Calico is an open-source networking and network security solution for containers, virtual machines, and native host-based workloads. It provides a highly scalable and efficient way to manage networking in Kubernetes environments. The package is widely used for its ability to enforce network policies and provide connectivity between workloads. However, it has a vulnerability that can expose sensitive information, specifically Kubernetes ServiceAccount tokens, through its logging mechanism.

Vulnerability Detail

In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the SERVICEACCOUNT_TOKEN placeholder, the installer substitutes the live Kubernetes ServiceAccount bearer token before logging. This exposes the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. This vulnerability is a direct regression of TTA-2018-001 and poses a significant risk to the security of Kubernetes clusters.

How To Fix

Latest published version: v3.21.1+incompatible as of 23 Oct 2026

go get github.com/projectcalico/calico@v3.21.1+incompatible

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
```
go get github.com/projectcalico/calico@v1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
```

>= 2.0.0, < 3.31.6 3.31.6

go get github.com/projectcalico/calico@v3.31.6

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a temporary workaround, you can modify the logging configuration to avoid logging sensitive information. This may involve changing the logging level or redirecting logs to a secure location where they cannot be accessed by unauthorized users.

Conclusion

CVE-2026-41184 is a significant vulnerability in Calico that exposes sensitive Kubernetes ServiceAccount tokens through logging. It is crucial for users to update to the patched versions to mitigate the risks associated with this vulnerability. Additionally, employing workarounds can help secure your environment until the update is applied.

See every vulnerability recorded for github.com/projectcalico/calico →

FAQ

What is CVE-2026-41184?

CVE-2026-41184 is a vulnerability in Calico that exposes Kubernetes ServiceAccount tokens in logs, potentially allowing unauthorized access to sensitive cluster information.

How does this vulnerability affect my Kubernetes cluster?

This vulnerability allows authenticated users with log access to view sensitive ServiceAccount tokens, which can be exploited to gain elevated privileges within the cluster.

What versions of Calico are affected?

Versions of Calico from 2.0.0 to 3.31.5 and from 0 to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f are affected by this vulnerability.

How can I check if my application is affected?

You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.

What is the CVSS score of this vulnerability?

The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.

References

Related vulnerabilities

Recent vulnerabilities recorded for github.com/projectcalico/calico.

View all github.com/projectcalico/calico vulnerabilities →