CVE-2026-41186 Details

A vulnerability exists in Tigera Calico's shared debug server, specifically within the kube-controllers and Goldmane components. When the debug server is enabled, these components expose a Go pprof debug listener to all network interfaces without authentication. This allows any pod with network access to the listener to access sensitive information such as the process heap, goroutine stacks (including function arguments), and command-line arguments. The heap may contain sensitive data depending on the process's in-memory state. This vulnerability is particularly concerning because the debug listener, while opt-in, lacks authentication and a safe localhost-only binding option. By default, the debug server is disabled, but if enabled in a production environment, it can lead to unauthorized exposure of sensitive information.

Users are advised not to enable the debug profile port in production environments. If it is currently enabled, it should be disabled. For those using Calico Open Source, versions prior to v3.31.6 and v3.32.0 through prior to v3.32.1 are affected. Calico Enterprise users should note that all versions prior to v3.21.7 and v3.22.0 through prior to v3.22.4 are vulnerable. Calico Cloud users should upgrade from versions prior to v22.4.0. Instructions for upgrading can be found in the Calico documentation.