CVE-2026-41186

Undergoing Analysis Undergoing Analysis - In Progress

Calico kube-controllers and Goldmane debug server information exposure

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Tigera, Inc.

Description

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-41186

EUVD

EUVD-2026-51155

Affected Vendors & Products

Vendor	Product	Version / Range
calico	calico_kube_controllers	*
calico	goldmane	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-489	The product is released with debugging code still enabled or active.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability involves Calico's shared debug server, which is disabled by default. When enabled, the kube-controllers and Goldmane components expose a Go pprof debug listener on all network interfaces (0.0.0.0) without requiring authentication. This allows any pod with network access to retrieve sensitive process information like heap data, goroutine stacks, and command-line arguments.

Detection Guidance

Check if the shared debug server is enabled by inspecting the Calico kube-controllers and Goldmane components for bound debug listeners on 0.0.0.0. Use commands like netstat -tulnp | grep :6060 or ss -tulnp | grep :6060 to detect listening ports. Verify process heap or goroutine exposure via unauthorized access attempts.

Impact Analysis

An attacker with network access to the debug listener could extract sensitive data from the process memory, such as credentials or configuration details. This could lead to unauthorized access, data breaches, or further exploitation of the cluster.

Compliance Impact

This vulnerability could lead to exposure of sensitive in-memory data, which may include personal or health information. This could violate GDPR's data protection principles or HIPAA's confidentiality requirements if such data is accessed by unauthorized parties.

Mitigation Strategies

Disable the shared debug server in Calico kube-controllers and Goldmane components. Ensure the debug listener binds only to localhost (127.0.0.1) if debugging is required. Restrict network access to the listener port using network policies or firewalls.

Hi! I’m here to help you understand CVE-2026-41186. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70