CVE-2026-6720 Details
Description
When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.
A vulnerability exists in Tigera Calico's command-line tool, calicoctl, when it is run with verbose log levels (info or debug). Under these conditions, calicoctl inadvertently logs sensitive connection details to stderr, including inline kubeconfig with bearer tokens, Kubernetes API bearer tokens, etcd passwords, and inline PEM-encoded etcd client certificates and keys. This information can be extracted by anyone with access to the stderr output, such as through CI job logs, session recordings, shared support ticket transcripts, or local file viewers on the host where calicoctl was executed. The issue arises because calicoctl's default log level is set to panic, meaning the vulnerability only manifests when verbose logging is explicitly activated.
Users can upgrade to Tigera Calico versions 3.31 or 3.32, both of which address this vulnerability by removing sensitive information from the logs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectcalico/calico/pull/12535 | [email protected] | Issue TrackingVendor |
| https://github.com/projectcalico/calico/pull/12536 | [email protected] | Issue TrackingVendor |
| https://github.com/projectcalico/calico/pull/12537 | [email protected] | Issue TrackingVendor |
| https://www.tigera.io/security-bulletins/tta-2026-003/ | [email protected] | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tigera calicoctl | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |