Medium 6.0Published Jul 30, 2026

CVE-2026-41186Unauthenticated Go pprof exposure in Calico debug server

Updated under an hour ago (Oct 27, 2026, 6:40 AM ET)

Does this affect you?

It affects Tigera Calico and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Tigera Calico

Exploited in the last 30 days

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.

CVSS: 6.0 MEDIUM (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L
Weakness (CWE): CWE-489, CWE-200
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Tigera
NVD analysis: Analyzed
Record last updated: Jul 30, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Tigera Calico tigera:calico (from the name)	before 3.31.6; from 3.32.0 before 3.32.1	CNA record
Tigera Calico Enterprise tigera:calico_enterprise (from the name)	before 3.21.7; from 3.22.0 before 3.22.4	CNA record
Tigera Calico Cloud tigera:calico_cloud (from the name)	before 22.4.0	CNA record
tigera calico tigera:calico	before 3.21.7; before 3.31.6; through 22.4.0; from 3.22.0 before 3.22.4; from 3.32.0 before 3.32.1	NVD

References

References

https://github.com/projectcalico/calico/pull/12491	patch, issue-tracking
https://github.com/projectcalico/calico/pull/12634	patch, issue-tracking
https://github.com/projectcalico/calico/pull/12633	patch, issue-tracking
https://www.tigera.io/security-bulletins/tta-2026-004/	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.