High 7.9Published Jul 30, 2026

CVE-2026-6540L7 policy bypass via unnormalized HTTP path matching

Updated under an hour ago (Oct 26, 2026, 2:10 PM ET)

Does this affect you?

It affects Tigera Calico and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Tigera Calico

Exploited in the last 30 days

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

CVSS: 7.9 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
Weakness (CWE): CWE-22, CWE-23
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Tigera
NVD analysis: Analyzed
Record last updated: Jul 30, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Tigera Calico tigera:calico (from the name)	before 3.31.6	CNA record
Tigera Calico Enterprise tigera:calico_enterprise (from the name)	before 3.21.7; from 3.22.0 before 3.22.4	CNA record
Tigera Calico Cloud tigera:calico_cloud (from the name)	before 22.4.0	CNA record
tigera calico tigera:calico	before 3.21.7; before 3.31.6; through 22.4.0; from 3.22.0 before 3.22.4; from 3.32.0 before 3.32.1	NVD

References

References

https://github.com/projectcalico/calico/pull/12531	patch, issue-tracking
https://github.com/projectcalico/calico/pull/12532	patch, issue-tracking
https://github.com/projectcalico/calico/pull/12533	patch, issue-tracking
https://www.tigera.io/security-bulletins/tta-2026-005/	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.