Medium 6.2Published Jul 30, 2026

CVE-2026-41187Calico Tier Authorization Bypass via DeleteCollection

Updated under an hour ago (Oct 27, 2026, 8:10 AM ET)

Does this affect you?

It affects Tigera Calico and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Tigera Calico

Exploited in the last 30 days

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

CVSS: 6.2 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H
Weakness (CWE): CWE-285, CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Tigera
NVD analysis: Analyzed
Record last updated: Jul 30, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Tigera Calico tigera:calico (from the name)	before 3.31.6; from 3.32.0 before 3.32.1	CNA record
Tigera Calico Enterprise tigera:calico_enterprise (from the name)	before 3.21.7; from 3.22.0 before 3.22.5	CNA record
Tigera Calico Cloud tigera:calico_cloud (from the name)	before 22.4.0	CNA record
tigera calico tigera:calico	before 3.21.7; before 3.31.6; through 22.4.0; from 3.22.0 before 3.22.4; from 3.32.0 before 3.32.1	NVD

References

References

https://github.com/projectcalico/calico/pull/12731	patch, issue-tracking
https://github.com/projectcalico/calico/pull/12735	patch, issue-tracking
https://github.com/projectcalico/calico/pull/12736	patch, issue-tracking
https://github.com/projectcalico/calico/pull/12737	patch, issue-tracking
https://www.tigera.io/security-bulletins/tta-2026-006/	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.