CVE-2026-41186 json
Unauthenticated Go pprof exposure in Calico debug server
published 2026-07-30 3 mo ago modified 2026-08-08 3 mo ago also EUVD-2026-51155
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.
Patch / fix
- Tigera Calico 3.31.6, 3.32.1
- Tigera Calico Enterprise 3.21.7, 3.22.4
- Tigera Calico Cloud 22.4.0
- github.com/projectcalico/calico#12491 pull request
- github.com/projectcalico/calico#12634 pull request
- github.com/projectcalico/calico#12633 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Tigera Calico
- Tigera Calico Enterprise
- Tigera Calico Cloud
Classification
References
-
github.com
/projectcalico/calico/pull/12491
patch, issue-tracking
-
github.com
/projectcalico/calico/pull/12634
patch, issue-tracking
-
github.com
/projectcalico/calico/pull/12633
patch, issue-tracking
-
tigera.io
/security-bulletins/tta-2026-004/
vendor-advisory
Sources
- CVE List CVE-2026-41186
- NVD CVE-2026-41186
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.