Vulnerabilities in pkg:golang/github.com/projectcalico/calicoctl/v3

PACKAGE
Advisory Identifier: GHSA-3m4q-ggcj-j6m4
Share
Advisory Summary

CVE-2026-6720 is a HIGH calico inserts sensitive information into vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting Github.com/projectcalico/calicoctl/v3 libraries in the Go ecosystem. The issue involves calico inserts sensitive information into log file. Remediation is available by upgrading affected packages to version 3.31.6.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:golang/github.com/projectcalico/calicoctl/v3

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:golang/github.com/projectcalico/calicoctl/v3. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-3m4q-ggcj-j6m4 CVE-2026-6720 HIGH Calico Inserts Sensitive Information into Log File

CVE-2026-6720 at a Glance

CVE Identifier CVE-2026-6720
GHSA Identifier GHSA-3m4q-ggcj-j6m4
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-532: Insertion of Sensitive Information into Log File
Affected Product Github.com/projectcalico/calicoctl/v3
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2026-6720

To remediate this vulnerability, upgrade all affected Github.com/projectcalico/calicoctl/v3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/projectcalico/calicoctl/v3 fixed: 3.31.6 
Upgrade github.com/projectcalico/calicoctl/v3 to 3.31.6
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/projectcalico/calicoctl/v3

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-6720, inspect your project dependencies for Github.com/projectcalico/calicoctl/v3:

inspect dependencies for github.com/projectcalico/calicoctl/v3

Analyze the terminal output to locate any version of Github.com/projectcalico/calicoctl/v3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.31.6), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File, where the product writes sensitive information to a log file. In Github.com/projectcalico/calicoctl/v3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.

CVE-2026-6720 Affected Github.com/projectcalico/calicoctl/v3 Versions

1 component(s)
Fixed Versions:
3.31.6
Product / Package Ecosystem Affected Versions Fixed Version
github.com/projectcalico/calicoctl/v3
golang/github.com/projectcalico/calicoctl/v3
Go
< 3.31.6
3.31.6

References

NVD — CVE-2026-6720 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6720
Github.com/projectcalico/calicoctl/v3 Source Repository REPOSITORY
https://github.com/projectcalico/calico/pull/12535
Github.com/projectcalico/calicoctl/v3 Source Repository REPOSITORY
https://github.com/projectcalico/calico/pull/12536
Github.com/projectcalico/calicoctl/v3 Source Repository REPOSITORY
https://github.com/projectcalico/calico/pull/12537
Security Fix Commit FIX COMMIT
https://github.com/projectcalico/calico/commit/12908bb48a5bf8cbab5373f4d532509a30cf9b7f
Security Fix Commit FIX COMMIT
https://github.com/projectcalico/calico/commit/8d87eddcb5eb6efc70c09eb0a33d63137359ea70
Security Fix Commit FIX COMMIT
https://github.com/projectcalico/calico/commit/ce3ab2b39b5841757cbccf7922c895c47827f562
Github.com/projectcalico/calicoctl/v3 Source Repository REPOSITORY
https://github.com/projectcalico/calico
Github.com/projectcalico/calicoctl/v3 Security Information SECURITY
https://www.tigera.io/security-bulletins/tta-2026-003

Frequently Asked Questions

What is CVE-2026-6720?
CVE-2026-6720 is a security vulnerability in Github.com/projectcalico/calicoctl/v3 involving Calico Inserts Sensitive Information into Log File under CWE-532: Insertion of Sensitive Information into Log File.
Which Github.com/projectcalico/calicoctl/v3 versions are affected?
Affected versions include releases prior to 3.31.6 across affected packages: github.com/projectcalico/calicoctl/v3.
What version fixes CVE-2026-6720?
Upgrading to 3.31.6 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/projectcalico/calicoctl/v3 affected?
Yes, github.com/projectcalico/calicoctl/v3 is affected in releases prior to 3.31.6. Upgrade your dependency to 3.31.6 or later.
What CWE is associated with CVE-2026-6720?
CVE-2026-6720 is classified under CWE-532: Insertion of Sensitive Information into Log File (The product writes sensitive information to a log file.).
How can I check Go dependencies for CVE-2026-6720?
Run the dependency tree command: 'inspect dependencies for github.com/projectcalico/calicoctl/v3'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3m4q-ggcj-j6m4",
  "modified" : "2026-07-02T18:07:41Z",
  "published" : "2026-05-28T18:30:32Z",
  "aliases" : [ "CVE-2026-6720" ],
  "summary" : "Calico Inserts Sensitive Information into Log File",
  "details" : "When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/projectcalico/calicoctl/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.31.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-6720"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/projectcalico/calico/pull/12535"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/projectcalico/calico/pull/12536"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/projectcalico/calico/pull/12537"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/projectcalico/calico/commit/12908bb48a5bf8cbab5373f4d532509a30cf9b7f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/projectcalico/calico/commit/8d87eddcb5eb6efc70c09eb0a33d63137359ea70"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/projectcalico/calico/commit/ce3ab2b39b5841757cbccf7922c895c47827f562"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/projectcalico/calico"
  }, {
    "type" : "WEB",
    "url" : "https://www.tigera.io/security-bulletins/tta-2026-003"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-532" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-02T18:07:41Z",
    "nvd_published_at" : "2026-05-28T17:16:33Z"
  }
}