CVE-2024-33522 json
Privilege escalation in Calico CNI install binary
published 2024-04-29 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1115 , GHSA-6362-gv4m-53ww , GO-2024-2801
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. The issue arises from an incorrect SUID (Set User ID) bit configuration in the binary, combined with the ability to control the input binary, allowing an attacker to execute an arbitrary binary with elevated privileges.
Patch / fix
- go github.com/projectcalico/calico 3.26.5, 3.27.3
- Tigera Calico v3.26.5, v3.27.3, v3.28.0
- Tigera Calico Enterprise v3.17.4, v3.18.2, v3.19.0-2.0
- Tigera Calico Cloud v19.3.0
- tigera calico_enterprise v3.17.4, v3.18.2, v3.19.0-2.0
- tigera calico_cloud v19.3.0
- github.com/projectcalico/calico#8447 pull request
- github.com/projectcalico/calico#8517 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/projectcalico/calico/issues/7981 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/projectcalico/calico | <3.26.5 >=3.27.0, <3.27.3 all versions |
3.26.5 3.27.3 |
| go | github.com/projectcalico/calico/v3 | all versions |
no fix listed |
Affected products
- Tigera Calico
- Tigera Calico Enterprise
- Tigera Calico Cloud
- tigera calico_enterprise
- tigera calico_cloud
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/projectcalico/calico/pull/8447
patch, web
-
github.com
/projectcalico/calico/pull/8517
patch, web
-
github.com
/projectcalico/calico/issues/7981
exploit, issue-tracking, web, report
-
tigera.io
/security-bulletins-tta-2024-001/
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-33522
advisory
-
github.com
/advisories/GHSA-6362-gv4m-53ww
advisory
-
github.com
/projectcalico/calico
package
-
pkg.go.dev
/vuln/GO-2024-2801
web
-
tigera.io
/security-bulletins-tta-2024-001
web
Sources
- CVE List CVE-2024-33522
- GitHub Advisory GHSA-6362-gv4m-53ww
- NVD CVE-2024-33522
- OSV GO-2024-2801
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.