CVE-2026-6540

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/projectcalico/calico/pull/12531	Issue Tracking Patch
https://github.com/projectcalico/calico/pull/12532	Issue Tracking Patch
https://github.com/projectcalico/calico/pull/12533	Issue Tracking Patch
https://www.tigera.io/security-bulletins/tta-2026-005/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tigera:calico:::::enterprise:::*
	cpe:2.3:a:tigera:calico:::::open_source:::*
	cpe:2.3:a:tigera:calico:::::cloud:::*
	cpe:2.3:a:tigera:calico:::::enterprise:::*
	cpe:2.3:a:tigera:calico:::::open_source:::*

History

No history.

Information

Published : 2026-07-30 15:16

Updated : 2026-08-08 01:10

NVD link : CVE-2026-6540

Mitre link : CVE-2026-6540

CVE.ORG link : CVE-2026-6540

JSON object : View

Products Affected

tigera

calico

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-23

Relative Path Traversal

{"id": "CVE-2026-6540", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6540", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T16:12:00.537090Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@tigera.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@tigera.io", "affectedData": [{"vendor": "Tigera", "product": "Calico", "versions": [{"status": "affected", "version": "0", "lessThan": "3.31.6", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Tigera", "product": "Calico Enterprise", "versions": [{"status": "affected", "version": "0", "lessThan": "3.21.7", "versionType": "semver"}, {"status": "affected", "version": "3.22.0", "lessThan": "3.22.4", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Tigera", "product": "Calico Cloud", "versions": [{"status": "affected", "version": "0", "lessThan": "22.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T15:16:37.533", "references": [{"url": "https://github.com/projectcalico/calico/pull/12531", "tags": ["Issue Tracking", "Patch"], "source": "psirt@tigera.io"}, {"url": "https://github.com/projectcalico/calico/pull/12532", "tags": ["Issue Tracking", "Patch"], "source": "psirt@tigera.io"}, {"url": "https://github.com/projectcalico/calico/pull/12533", "tags": ["Issue Tracking", "Patch"], "source": "psirt@tigera.io"}, {"url": "https://www.tigera.io/security-bulletins/tta-2026-005/", "tags": ["Vendor Advisory"], "source": "psirt@tigera.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@tigera.io", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict."}], "lastModified": "2026-08-08T01:10:43.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "68BC4A3E-A53E-463F-B627-EB21276BE079", "versionEndExcluding": "3.21.7"}, {"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "1DB36B83-2C1A-4D26-8E29-C4BB8D7AEFD2", "versionEndExcluding": "3.31.6"}, {"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*", "vulnerable": true, "matchCriteriaId": "62C57322-0A64-41C8-8145-E1471107973D", "versionEndIncluding": "22.4.0"}, {"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E4BE9961-DD19-41BE-8F40-456752DB141A", "versionEndExcluding": "3.22.4", "versionStartIncluding": "3.22.0"}, {"criteria": "cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "BE55BC32-7899-4C2A-8EED-A81B36E95077", "versionEndExcluding": "3.32.1", "versionStartIncluding": "3.32.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@tigera.io"}