CVE-2026-6540 json
L7 policy bypass via unnormalized HTTP path matching
published 2026-07-30 3 mo ago modified 2026-08-08 3 mo ago also EUVD-2026-51153
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
Patch / fix
- Tigera Calico 3.31.6
- Tigera Calico Enterprise 3.21.7, 3.22.4
- Tigera Calico Cloud 22.4.0
- github.com/projectcalico/calico#12531 pull request
- github.com/projectcalico/calico#12532 pull request
- github.com/projectcalico/calico#12533 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L |
| CNA | 4.0 | 7.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Tigera Calico
- Tigera Calico Enterprise
- Tigera Calico Cloud
Classification
References
-
github.com
/projectcalico/calico/pull/12531
patch, issue-tracking
-
github.com
/projectcalico/calico/pull/12532
patch, issue-tracking
-
github.com
/projectcalico/calico/pull/12533
patch, issue-tracking
-
tigera.io
/security-bulletins/tta-2026-005/
vendor-advisory
Sources
- CVE List CVE-2026-6540
- NVD CVE-2026-6540
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.