CVE-2026-41187 Details
Description
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.
A vulnerability in Tigera Calico's apiserver allows for an authorization bypass on tier-scoped NetworkPolicy and GlobalNetworkPolicy resources. The issue arises because the Delete override for these policies is not applied during DeleteCollection requests. As a result, a user with the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers where they lack authorization, disrupting policy enforcement. This vulnerability affects Calico Open Source versions prior to v3.31.6 and v3.32.0 through prior to v3.32.1, as well as Calico Enterprise versions prior to v3.21.7 and v3.22.0 through prior to v3.22.5. Calico Cloud users prior to v22.4.0 are also affected.
Users should upgrade to Calico Open Source v3.31.6 or v3.32.1, Calico Enterprise v3.21.7 or v3.22.5, or Calico Cloud v22.4.0 and later. Additionally, avoid granting the deletecollection verb or wildcard verbs on tier-scoped policy resources to users who should not have the ability to delete policies across tiers.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectcalico/calico/pull/12731 | [email protected] | Issue TrackingPatch |
| https://github.com/projectcalico/calico/pull/12735 | [email protected] | Issue TrackingPatch |
| https://github.com/projectcalico/calico/pull/12736 | [email protected] | Issue TrackingPatch |
| https://github.com/projectcalico/calico/pull/12737 | [email protected] | Issue TrackingPatch |
| https://www.tigera.io/security-bulletins/tta-2026-006/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tigera calico | < 3.21.7 < 3.31.6 <= 22.4.0 >= 3.22.0, < 3.22.4 >= 3.32.0, < 3.32.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |