CVE-2026-41187

Undergoing Analysis Undergoing Analysis - In Progress

Calico apiserver tier-scoped policy deletion bypass

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Tigera, Inc.

Description

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-41187

EUVD

EUVD-2026-51154

Affected Vendors & Products

Vendor	Product	Version / Range
calico	apiserver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves Calico's apiserver not properly enforcing tier authorization boundaries for DeleteCollection requests on tier-scoped resources like NetworkPolicy and GlobalNetworkPolicy. The Delete override is bypassed, allowing users with deletecollection verb or wildcard permissions to bulk-delete policies in tiers they lack rights to access.

Detection Guidance

This vulnerability involves unauthorized bulk deletion of tier-scoped policies due to improper authorization checks in Calico's apiserver. To detect it, monitor for unexpected deletion of NetworkPolicy or GlobalNetworkPolicy resources, especially via DeleteCollection requests. Check audit logs for users with deletecollection verb or wildcard permissions on tier-scoped resources.

Impact Analysis

An attacker with deletecollection permissions could delete policies across unauthorized tiers, disrupting network security controls. This could lead to unauthorized network access, data breaches, or denial of service by removing critical security policies.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized deletion of security policies, potentially exposing sensitive data or systems. It undermines access controls and audit trails, which are critical for GDPR and HIPAA compliance.

Mitigation Strategies

Restrict deletecollection verb and wildcard permissions on tier-scoped policy resources like NetworkPolicy and GlobalNetworkPolicy to prevent unauthorized bulk deletions.

Hi! I’m here to help you understand CVE-2026-41187. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70