VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jul 30, 2026· Updated Aug 8, 2026

CVE-2026-41187

CVE-2026-41187

Description

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Tigera/Calico4 versions
    cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*+ 3 more
    • cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*range: <3.21.7
    • cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*range: <3.31.6
    • cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*range: <=22.4.0
    • (no CPE)
  • Projectcalico/Calicollm-fuzzy
  • osv-coords
    pkg:apk/chainguard/calico-cni-fips-3.31
    Range: < 3.31.6-r8

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.