CVE-2026-41186 in Calico
Summary
by MITRE • 07/30/2026
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
Calico's shared debug server functionality represents a significant security vulnerability that arises from improper default configuration and lack of access controls in production environments. When enabled, the kube-controllers and other Calico components expose Go pprof debug interfaces bound to all network interfaces rather than restricting access to localhost only. This configuration creates an attack surface where any entity with network connectivity to the affected pods can access detailed runtime information through the unauthenticated debug endpoints. The vulnerability stems from a fundamental design flaw in how the debug server handles network binding and authentication mechanisms, effectively providing attackers with comprehensive visibility into running processes without any form of access control.
The technical impact of this vulnerability extends beyond simple information disclosure through the exposure of goroutine stacks that may contain function arguments and sensitive operational data. The heap memory dumps accessible through the pprof interface can potentially contain confidential information such as API keys, tokens, passwords, or other credentials stored in process memory during runtime operations. This exposure represents a critical risk for containerized environments where multiple pods share the same network namespace or when network policies are misconfigured to allow unnecessary external access. The vulnerability aligns with CWE-284 Access Control Issues and specifically demonstrates poor privilege management practices in system components that should never expose debugging interfaces to untrusted networks.
The operational consequences of this vulnerability are severe for organizations relying on Calico for network policy enforcement, as attackers who gain network access to the cluster can leverage this debug interface to understand the internal workings of the networking components. This information can then be used to craft more sophisticated attacks against the broader Kubernetes environment, potentially leading to privilege escalation or lateral movement within the cluster. The vulnerability affects both the kube-controllers and other Calico components that may be running in production environments where debugging features are enabled for troubleshooting purposes but not properly secured. Security teams must recognize this as a critical configuration issue that can undermine the security posture of containerized applications.
Organizations should implement immediate mitigations to address this vulnerability by ensuring that debug interfaces remain disabled in production environments and that any intentional enabling requires explicit authentication mechanisms. The recommended approach involves configuring network policies to restrict access to debug endpoints, implementing proper binding to localhost only when debugging is required, and establishing monitoring for unauthorized access attempts to these interfaces. Additionally, security teams should conduct comprehensive audits of all Calico components within their clusters to identify whether debug servers have been enabled and ensure that appropriate controls are in place to prevent unauthorized access. This vulnerability demonstrates the critical importance of principle of least privilege in containerized environments and the necessity of securing debugging interfaces as part of overall infrastructure hardening practices.