CVE-2026-6540 in Calico
Summary
by MITRE • 07/30/2026
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
Calico's Application Layer Policy represents a critical security gap within containerized network environments that leverages the Dikastes component to enforce HTTP-based access controls. This vulnerability stems from insufficient URL path normalization within the policy enforcement mechanism, creating a fundamental mismatch between the authorization decision made by Dikastes and the actual path handling performed by downstream systems. The flaw specifically impacts Prefix path rules where HTTP requests containing path-traversal segments, encoded slashes, or repeated slashes bypass the intended access controls due to the lack of proper path canonicalization during policy evaluation.
The technical implementation issue manifests when Dikastes evaluates incoming HTTP requests against configured prefix-based rules without performing comprehensive URL normalization before making authorization decisions. This creates a scenario where an attacker can craft requests that appear to comply with the permitted prefix path but actually contain normalized paths that access restricted endpoints. The vulnerability operates at the intersection of network security policy enforcement and application layer handling, where the policy engine's decision-making process fails to account for the various ways HTTP paths can be represented and normalized by different components in the request processing pipeline.
From an operational perspective, this vulnerability significantly undermines the security posture of environments relying on Calico's Application Layer Policy for HTTP access control. Network attackers with basic access permissions can exploit this weakness to bypass intended restrictions without requiring elevated privileges or specialized role-based access controls. The impact extends beyond simple unauthorized access as it represents a fundamental failure in the principle of least privilege enforcement, allowing attackers to potentially reach sensitive endpoints that should be restricted based on the configured policy rules. This creates a persistent risk where legitimate security controls are effectively circumvented through path manipulation techniques.
The vulnerability demonstrates characteristics consistent with CWE-174, which addresses insufficient canonicalization of path names, and aligns with ATT&CK technique T1071.004 for application layer protocol usage in network communication. Organizations utilizing Calico's Application Layer Policy must recognize that this weakness creates a false sense of security where access controls appear to function correctly but actually provide incomplete protection. The mitigation strategy requires either enabling proper URL path normalization within Dikastes before authorization decisions or implementing compensating controls such as downstream proxy configurations that enforce consistent path handling across the entire request processing chain.
Security practitioners should consider this vulnerability in the context of broader network security architecture design, particularly when implementing zero-trust principles where every request must be validated independently regardless of how it might appear to comply with initial policy checks. The issue highlights the importance of consistent path handling across all layers of network security enforcement and demonstrates why policy engines must account for the full spectrum of HTTP request representations that can occur in real-world deployments. Organizations should prioritize updating their Calico implementations to address this normalization gap while also implementing monitoring for suspicious path manipulation patterns that might indicate exploitation attempts.