Vulnerability · Published May 28, 2026 · Assigned by Tigera
CVE-2026-41184ServiceAccount token disclosure via install-cni container logs
Medium 6.0
In plain English
A medium-severity sensitive data in logs in Calico from Tigera. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/projectcalico/calico | 3.31.6 | GHSA-9p7w-w5q6-mxj3 |
| Go | github.com/projectcalico/calico | 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f | GHSA-9p7w-w5q6-mxj3 |
| Go | github.com/projectcalico/calico | 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f | GO-2026-5888 |
| Go | github.com/projectcalico/calico/v3 | no fix listed | GO-2026-5888 |
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L