CVE-2026-41187

MediumCVSS 6.5/10Last modified Aug 8, 2026

Description

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
Tigera	Calico	< 3.31.6; >= 3.32.0, < 3.32.1
Tigera	Calico Enterprise	< 3.21.7; >= 3.22.0, < 3.22.5
Tigera	Calico Cloud	< 22.4.0

References

https://github.com/projectcalico/calico/pull/12731Issue Tracking, Patch
https://github.com/projectcalico/calico/pull/12735Issue Tracking, Patch
https://github.com/projectcalico/calico/pull/12736Issue Tracking, Patch
https://github.com/projectcalico/calico/pull/12737Issue Tracking, Patch
https://www.tigera.io/security-bulletins/tta-2026-006/Vendor Advisory

Timeline

Published: Jul 30, 2026
Last modified: Aug 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-411897.1FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `Threa CVE-2026-41199.1The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin regist CVE-2026-411907.1FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when `APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS` is enabl CVE-2026-411917.1FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, `MailboxesController::updateSave()` persists `chat_s CVE-2026-411927.1FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encr CVE-2026-411939.1FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP CVE-2026-411945.4FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the mailbox OAuth disconnect action is implemented a CVE-2026-411955.0mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows CVE-2026-4119610.0Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a maliciou CVE-2026-411979.3Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the CVE-2026-41206.4The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' param CVE-2026-412008.5STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Vers