Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-41185

When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation — once per pod scheduled or terminated on the node. When the cluster is deployed using token-based Kubernetes authentication, this log entry
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:1d02d2c67842045b607e1f39740f475846890ba9d04f3a366f14cd8f1d36c1dd
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 3 assertions

{"defaultStatus":"affected","product":"Calico Enterprise","vendor":"Tigera","versions":[{"lessThan":"3.21.7","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.22.3","status":"affected","version":"3.22.0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/affected/1

{"defaultStatus":"affected","product":"Calico","vendor":"Tigera","versions":[{"lessThan":"3.32.0","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Calico Cloud","vendor":"Tigera","versions":[{"lessThan":"22.4.0","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/affected/2

Affected products and versions

3 source assertions
{"defaultStatus":"affected","product":"Calico Enterprise","vendor":"Tigera","versions":[{"lessThan":"3.21.7","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.22.3","status":"affected","version":"3.22.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/affected/1
{"defaultStatus":"affected","product":"Calico","vendor":"Tigera","versions":[{"lessThan":"3.32.0","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Calico Cloud","vendor":"Tigera","versions":[{"lessThan":"22.4.0","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/affected/2

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"H…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-532","description":"CWE-532 Insertion of sensitive information into log file","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions
{"tags":["patch"],"url":"https://github.com/projectcalico/calico/pull/12502"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/references/0
{"tags":["patch"],"url":"https://github.com/projectcalico/calico/pull/12526"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/references/2
{"tags":["patch"],"url":"https://github.com/projectcalico/calico/pull/12527"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/references/1
{"tags":["vendor-advisory"],"url":"https://www.tigera.io/security-bulletins/tta-2026-002/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:435dcf6504c6c7fd7c794181429d2e0f96839af69519dedbe6223e67b56ae183 · sha256:edf6e5235599b969… · /containers/cna/references/3

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer