CVE-2026-41187
Vulnerability Description
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-285
Source
NVD
Vendor
Tigera
Product
Calico, Calico Enterprise, Calico Cloud
Discussion (0)
Add Comment
No comments yet. Be the first!