CVE-2026-41185: Github.com/projectcalico/calico Calico Inserts Sensitive Information Into Vulnerability
MODERATECVE-2026-41185 is a MODERATE (CVSS 6.5) calico inserts sensitive information into vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting Github.com/projectcalico/calico libraries in the Go ecosystem. The issue involves calico inserts sensitive information into log file. Remediation is available by upgrading affected packages to version 3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f.
CVE-2026-41185 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2026-41185
To remediate this vulnerability, upgrade all affected Github.com/projectcalico/calico dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/projectcalico/calico to 3.31.6Upgrade github.com/projectcalico/calico to 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0fRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/projectcalico/calicoHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-41185, inspect your project dependencies for Github.com/projectcalico/calico:
inspect dependencies for github.com/projectcalico/calicoAnalyze the terminal output to locate any version of Github.com/projectcalico/calico in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.31.6), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File, where the product writes sensitive information to a log file. In Github.com/projectcalico/calico, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-41185 Affected Github.com/projectcalico/calico Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/projectcalico/calico
|
Go |
≥ 2.0.0
< 3.31.6
|
3.31.6
|
|
github.com/projectcalico/calico
|
Go |
< 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
|
1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
|
References
Frequently Asked Questions
What is CVE-2026-41185?
Which Github.com/projectcalico/calico versions are affected?
What version fixes CVE-2026-41185?
Is github.com/projectcalico/calico affected?
What is the CVSS score of CVE-2026-41185?
What CWE is associated with CVE-2026-41185?
How can I check Go dependencies for CVE-2026-41185?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-m67g-87rx-v42c",
"modified" : "2026-07-02T17:30:20Z",
"published" : "2026-05-28T18:30:31Z",
"aliases" : [ "CVE-2026-41185" ],
"summary" : "Calico Inserts Sensitive Information into Log File",
"details" : "When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation — once per pod scheduled or terminated on the node. When the cluster is deployed using token-based Kubernetes authentication, this log entry contains the ServiceAccount token, client key, and certificate authority in plaintext. Any principal with read access to /var/log/calico/cni/cni.log on a node can read these logs and extract the credentials, which grant cluster-wide Calico networking admin privileges.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/projectcalico/calico"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "3.31.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/projectcalico/calico"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41185"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcalico/calico/pull/12502"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcalico/calico/pull/12526"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcalico/calico/pull/12527"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcalico/calico/commit/0ca653db0ae7400ea9fb066daa7f45c902482271"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcalico/calico/commit/cd73bc2cea0f4989772f2deb93909e7cfac927e0"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcalico/calico/commit/da9ea3a13927a35e4022b787d17a005b2157d812"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/projectcalico/calico"
}, {
"type" : "WEB",
"url" : "https://www.tigera.io/security-bulletins/tta-2026-002"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-532" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-02T17:30:20Z",
"nvd_published_at" : "2026-05-28T17:16:22Z"
}
}