Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-41187

Опубликовано: 30 июл. 2026
Источник: nvd
CVSS3: 6.5
EPSS Низкий

Описание

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*
Версия до 3.21.7 (исключая)
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*
Версия до 3.31.6 (исключая)
cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*
Версия до 22.4.0 (включая)
cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*
Версия от 3.22.0 (включая) до 3.22.4 (исключая)
cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*
Версия от 3.32.0 (включая) до 3.32.1 (исключая)

EPSS

Процентиль: 13%
0.0022
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-285

Связанные уязвимости

github логотип

GHSA-38w4-qxg9-xg36

CVSS3: 6.5
github
около 2 месяцев назад

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

EPSS

Процентиль: 13%
0.0022
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-285