PatchTheCVEcalico vulnerabilities and fixes
Recent CVEs affecting calico, with upgrade or downgrade steps. 4 tracked.
calico has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-07-30. Highest priority: CVE-2026-41186 (score 44/100).
- CVE-2026-41184 MEDIUM 6.5 UPGRADE In Calico, the install-cni init container logs the rendered CNI configuration to standard output
- CVE-2026-41186 HIGH 7.5 UPGRADE When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane c
- CVE-2026-41187 MEDIUM 6.5 UPGRADE Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, bu
- CVE-2026-6540 HIGH 7.5 UPGRADE Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to
FAQ
How do I fix calico vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is calico being exploited right now?
None of the tracked calico CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which calico CVE should I patch first?
CVE-2026-41186 currently ranks highest (44/100): When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane c.