CVE-2026-6540 Details
Description
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
A vulnerability exists in Tigera Calico's Application Layer Policy (ALP), which is disabled by default. The issue arises because the policy enforcement, managed through a component called Dikastes, does not properly normalize URL paths. This flaw allows HTTP requests that include path-traversal segments, encoded slashes, or repeated slashes to bypass 'Prefix' path rules. As a result, Dikastes may incorrectly authorize these requests, permitting access to restricted endpoints that the policy was designed to protect. This vulnerability affects Calico Open Source versions prior to v3.31.6, Calico Enterprise versions prior to v3.21.7 and v3.22.0 through prior to v3.22.4, and Calico Cloud versions prior to v22.4.0.
Users can upgrade to Calico Open Source v3.31.6 or v3.32.0, Calico Enterprise v3.21.7 or v3.22.4, and Calico Cloud v22.4.0 and later. Until the upgrade is performed, it is advised not to rely on 'Prefix' L7 path rules as a security boundary.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectcalico/calico/pull/12531 | [email protected] | Issue TrackingPatch |
| https://github.com/projectcalico/calico/pull/12532 | [email protected] | Issue TrackingPatch |
| https://github.com/projectcalico/calico/pull/12533 | [email protected] | Issue TrackingPatch |
| https://www.tigera.io/security-bulletins/tta-2026-005/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-23 | Relative Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tigera calico | < 3.21.7 < 3.31.6 <= 22.4.0 >= 3.22.0, < 3.22.4 >= 3.32.0, < 3.32.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |