https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-6540.htmlhttps://patchthecve.com/cve/CVE-2026-6540.htmlSat, 08 Aug 2026 01:10:43 +0000HIGH 7.5: Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authhttps://patchthecve.com/cve/CVE-2026-41187.htmlhttps://patchthecve.com/cve/CVE-2026-41187.htmlSat, 08 Aug 2026 01:16:27 +0000MEDIUM 6.5: Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbhttps://patchthecve.com/cve/CVE-2026-41186.htmlhttps://patchthecve.com/cve/CVE-2026-41186.htmlSat, 08 Aug 2026 01:20:02 +0000HIGH 7.5: When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including fhttps://patchthecve.com/cve/CVE-2026-41184.htmlhttps://patchthecve.com/cve/CVE-2026-41184.htmlMon, 26 Oct 2026 13:10:00 +0000MEDIUM 6.5: In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging