Vulnerabilities CVE-2026-41187

CVE-2026-41187

Medium

Open

TLP:CLEAR

Calico Tier Authorization Bypass via DeleteCollection

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Details

CVSS Score: 6.2
EPSS Score ⓘ: 0.22%

12.6th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H
Confidence: 90%
Published: Jul 30, 2026
Last Modified: Jul 30, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.