CVE-2026-41186

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.

CVSS

No CVSS.

References

Link	Resource
https://github.com/projectcalico/calico/pull/12491
https://github.com/projectcalico/calico/pull/12633
https://github.com/projectcalico/calico/pull/12634
https://www.tigera.io/security-bulletins/tta-2026-004/

Configurations

No configuration.

History

30 Jul 2026, 15:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-30 15:16

Updated : 2026-07-30 17:16

NVD link : CVE-2026-41186

Mitre link : CVE-2026-41186

CVE.ORG link : CVE-2026-41186

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-489

Active Debug Code

{"id": "CVE-2026-41186", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41186", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T16:10:46.313327Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@tigera.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@tigera.io", "affectedData": [{"vendor": "Tigera", "product": "Calico", "versions": [{"status": "affected", "version": "0", "lessThan": "3.31.6", "versionType": "semver"}, {"status": "affected", "version": "3.32.0", "lessThan": "3.32.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Tigera", "product": "Calico Enterprise", "versions": [{"status": "affected", "version": "0", "lessThan": "3.21.7", "versionType": "semver"}, {"status": "affected", "version": "3.22.0", "lessThan": "3.22.4", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Tigera", "product": "Calico Cloud", "versions": [{"status": "affected", "version": "0", "lessThan": "22.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T15:16:31.677", "references": [{"url": "https://github.com/projectcalico/calico/pull/12491", "source": "psirt@tigera.io"}, {"url": "https://github.com/projectcalico/calico/pull/12633", "source": "psirt@tigera.io"}, {"url": "https://github.com/projectcalico/calico/pull/12634", "source": "psirt@tigera.io"}, {"url": "https://www.tigera.io/security-bulletins/tta-2026-004/", "source": "psirt@tigera.io"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@tigera.io", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-489"}]}], "descriptions": [{"lang": "en", "value": "When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option."}], "lastModified": "2026-07-30T17:16:31.463", "sourceIdentifier": "psirt@tigera.io"}