Vulnerability-Lookup

GHSA-GM75-WG2C-P77X

Vulnerability from github – Published: 2026-07-30 15:31 – Updated: 2026-07-30 15:31

Details

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

Severity

7.9 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-6540"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-30T15:16:37Z",
    "severity": "HIGH"
  },
  "details": "Calico\u0027s Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.",
  "id": "GHSA-gm75-wg2c-p77x",
  "modified": "2026-07-30T15:31:53Z",
  "published": "2026-07-30T15:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6540"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcalico/calico/pull/12531"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcalico/calico/pull/12532"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcalico/calico/pull/12533"
    },
    {
      "type": "WEB",
      "url": "https://www.tigera.io/security-bulletins/tta-2026-005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-6540 (GCVE-0-2026-6540)

Vulnerability from cvelistv5 – Published: 2026-07-30 14:45 – Updated: 2026-07-30 16:12

Title

L7 policy bypass via unnormalized HTTP path matching

Summary

Severity

7.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23 - Relative Path Traversal

Assigner

Tigera

References

4 references

URL	Tags
https://github.com/projectcalico/calico/pull/12531	patch
https://github.com/projectcalico/calico/pull/12532	patch
https://github.com/projectcalico/calico/pull/12533	patch
https://www.tigera.io/security-bulletins/tta-2026-005/	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Tigera	Calico	Affected: 0 , < 3.31.6 (semver)
Tigera	Calico Enterprise	Affected: 0 , < 3.21.7 (semver) Affected: 3.22.0 , < 3.22.4 (semver)
Tigera	Calico Cloud	Affected: 0 , < 22.4.0 (semver)

Date Public

2026-07-30 16:00

Credits

Behnam Shobiri Seth Malaki Anthony Tam Matt Dupre

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6540",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T16:12:00.537090Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T16:12:07.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Calico",
          "vendor": "Tigera",
          "versions": [
            {
              "lessThan": "3.31.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Calico Enterprise",
          "vendor": "Tigera",
          "versions": [
            {
              "lessThan": "3.21.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.22.4",
              "status": "affected",
              "version": "3.22.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Calico Cloud",
          "vendor": "Tigera",
          "versions": [
            {
              "lessThan": "22.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Behnam Shobiri"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Seth Malaki"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Anthony Tam"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Matt Dupre"
        }
      ],
      "datePublic": "2026-07-30T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCalico\u0027s Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.\u003c/p\u003e"
            }
          ],
          "value": "Calico\u0027s Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T14:45:04.068Z",
        "orgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d",
        "shortName": "Tigera"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/projectcalico/calico/pull/12531"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/projectcalico/calico/pull/12532"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/projectcalico/calico/pull/12533"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tigera.io/security-bulletins/tta-2026-005/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "L7 policy bypass via unnormalized HTTP path matching",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d",
    "assignerShortName": "Tigera",
    "cveId": "CVE-2026-6540",
    "datePublished": "2026-07-30T14:45:04.068Z",
    "dateReserved": "2026-04-17T17:41:32.750Z",
    "dateUpdated": "2026-07-30T16:12:07.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-GM75-WG2C-P77X

CVE-2026-6540 (GCVE-0-2026-6540)

Tags

Sightings

Nomenclature