CVE-2026-41185: Calico CNI Plugin Exposes Sensitive Information in Logs
Summary
CVE-2026-41185: Calico Inserts Sensitive Information into Log File. Affects github.com/projectcalico/calico across 2 version ranges.
< 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
>= 2.0.0, < 3.31.6
Fixed in 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f or 3.31.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Calico is a popular open-source networking and network security solution for containers, virtual machines, and native host-based workloads. It provides a highly scalable and flexible networking solution for Kubernetes and other orchestration platforms. The Azure IPAM plugin allows Calico to manage IP addresses in Azure environments. However, a vulnerability exists in the way Calico handles incoming CNI configurations, leading to potential exposure of sensitive information.
Vulnerability Detail
The vulnerability arises when Calico is configured with the Azure IPAM plugin. During the processing of CNI configuration, the Calico CNI binary modifies the incoming configuration to include subnet information. This modified configuration is then logged at the INFO level in the file /var/log/calico/cni/cni.log every time a CNI ADD or DEL command is executed. In environments using token-based Kubernetes authentication, these logs can contain sensitive information such as ServiceAccount tokens, client keys, and certificate authorities in plaintext. Any user with read access to the log file can extract these credentials, which could grant them unauthorized access and control over Calico networking, posing a significant security risk.
How To Fix
Latest published version: v3.21.1+incompatible as of 23 Oct 2026
go get github.com/projectcalico/calico@v3.21.1+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0fgo get github.com/projectcalico/calico@v1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f -
>= 2.0.0, < 3.31.63.31.6go get github.com/projectcalico/calico@v3.31.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to the log file /var/log/calico/cni/cni.log to prevent unauthorized users from reading it. This can be done by changing the file permissions using the command: 'chmod 600 /var/log/calico/cni/cni.log'. However, this does not resolve the underlying issue and should only be used until an update can be applied.
Conclusion
CVE-2026-41185 presents a significant risk to users of the Calico CNI plugin when configured with the Azure IPAM plugin. It is crucial to update to the patched versions to secure sensitive information and prevent unauthorized access. Users should also consider implementing temporary workarounds to limit exposure until updates can be applied.
See every vulnerability recorded for github.com/projectcalico/calico →
FAQ
CVE-2026-41185 is a vulnerability in the Calico CNI plugin that exposes sensitive information in log files when configured with the Azure IPAM plugin.
The logs may contain ServiceAccount tokens, client keys, and certificate authorities in plaintext, which can be exploited by unauthorized users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
The best way to mitigate this vulnerability is to update to the patched version of the Calico package as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/projectcalico/calico.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
