CVE-2026-41187 in Calico
Summary
by MITRE • 07/30/2026
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability exists within Calico's apiserver implementation where tier-scoped network policy resources are protected by authorization mechanisms that should enforce strict access controls across different security tiers. The core issue stems from an inconsistent application of authorization checks during delete operations, specifically affecting NetworkPolicy and GlobalNetworkPolicy resources along with their staged variants. While the system correctly implements AuthorizeTierOperation for individual resource deletions, it fails to invoke this same authorization check for DeleteCollection requests, creating a critical bypass in the security model.
The technical flaw manifests when a malicious actor or compromised user possesses the deletecollection verb or wildcard permissions on tier-scoped policy resources. This permission allows them to execute bulk deletion operations that circumvent the normal tier authorization boundaries that should prevent access to policies in tiers they shouldn't be able to modify. The vulnerability directly violates the principle of least privilege and breaks the fundamental security model designed to isolate different security domains within the network policy system.
This authorization bypass has significant operational impact as it allows unauthorized users to potentially disrupt network security by removing critical policies from protected tiers, effectively weakening the overall security posture of the Calico network infrastructure. The vulnerability can be exploited to perform large-scale policy removals that may compromise network segmentation, allow unintended traffic flows, or disable crucial security controls across multiple resources simultaneously.
The issue aligns with CWE-284 Access Control Bypass and represents a failure in implementing proper authorization checks for bulk operations within the Kubernetes API server extension model. From an ATT&CK perspective, this vulnerability maps to privilege escalation techniques where attackers can leverage existing permissions to gain unauthorized access to restricted network security resources. The vulnerability demonstrates poor least privilege implementation and highlights the importance of consistent authorization enforcement across all API operation types including bulk operations.
Mitigation strategies should focus on ensuring that DeleteCollection operations properly invoke the same authorization checks as individual delete operations, implementing comprehensive testing of authorization boundaries for all supported API verbs, and reviewing similar patterns in other resource types. Organizations should immediately audit their Calico configurations to identify users or roles with wildcard permissions on network policy resources, and implement more granular access controls. The fix requires modifying the DeleteCollection handler to properly validate tier authorization before allowing bulk deletion operations to proceed, ensuring that all delete operations maintain consistent security boundaries regardless of whether they target individual resources or collections.
This vulnerability underscores the critical importance of thorough authorization testing for bulk operations in Kubernetes API server extensions and highlights how seemingly minor implementation gaps can create significant security risks. The issue demonstrates the need for comprehensive security reviews that examine not just individual operations but also the interaction patterns between different API verb types and their impact on access control models.