CVE-2026-41187

Calico Tier Authorization Bypass via DeleteCollection

6.2 Medium

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.39%Up 0.1 points since Jul 31, 2026

What each source reports

CVE List Score used 6.2

Calico Tier Authorization Bypass via DeleteCollection

Record: CVE-2026-41187
CVSS 4.0: 6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H
Weakness: CWE-285, CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-51154 6.2

Record: EUVD-2026-51154
CVSS 4.0: 6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-38w4-qxg9-xg36 6.2

Calico's apiserver wraps tier-scoped resources so that every operation runs through...

Record: GHSA-38w4-qxg9-xg36
CVSS 4.0: 6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-285
Updated: 2026-11-02

NVD 6.2

Record: CVE-2026-41187
CVSS 4.0: 6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-285, CWE-863
Updated: 2026-11-02

OSV 6.2

Calico Tier Authorization Bypass via DeleteCollection

Record: CVE-2026-41187
CVSS 4.0: 6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H
Weakness: CWE-285, CWE-863
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41187 is a medium vulnerability (CVSS 6.2) in Tigera Calico, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. No source names a fixed version.