6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41185

CVE-2026-41185: ServiceAccount token disclosure via Azure IPAM CNI plugin logs

When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation — once per pod scheduled or terminated on the node. When the cluster is deployed using token-based Kubernetes authentication, this log entry contains the ServiceAccount token, client key, and certificate authority in plaintext. Any principal with read access to /var/log/calico/cni/cni.log on a node can read these logs and extract the credentials, which grant cluster-wide Calico networking admin privileges.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41185

CVE-2026-41185:

6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/projectcalico/calico	go	>= 2.0.0, < 3.31.6	3.31.6
github.com/projectcalico/calico	go	< 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f	1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the excessive logging of CNI configuration data by the Calico CNI plugin. The analysis of the provided patches confirms that sensitive information was being written to log files. The patches consistently remove logging statements that output the entire configuration object, which could contain plaintext credentials.

The primary vulnerable functions identified are MutateConfigAdd and MutateConfigDel in cni-plugin/internal/pkg/azure/azure.go, which are part of the Azure IPAM helper. These functions were logging the complete stdinData on every CNI ADD and DEL operation. Additionally, the writeCNIConfig function in cni-plugin/pkg/install/install.go was logging the configuration content in case of a JSON validation error and also after writing the configuration file. An attacker with read access to the log file /var/log/calico/cni/cni.log on a node could extract Kubernetes ServiceAccount tokens and other credentials, leading to privilege escalation within the cluster.

Vulnerable functions

MutateConfigAdd

cni-plugin/internal/pkg/azure/azure.go

The function `MutateConfigAdd` was logging the entire CNI configuration (`stdinData`) at INFO level. When using token-based Kubernetes authentication, this configuration contains sensitive credentials like ServiceAccount tokens, client keys, and certificate authorities in plaintext. The patch removes the logging of the full `stdinData` object.

MutateConfigDel

cni-plugin/internal/pkg/azure/azure.go

Similar to `MutateConfigAdd`, the function `MutateConfigDel` was logging the entire CNI configuration (`stdinData`) at INFO level, which could contain sensitive credentials. The patch removes this logging and only logs specific, non-sensitive fields.

writeCNIConfig

cni-plugin/pkg/install/install.go

The function `writeCNIConfig` was logging the CNI network configuration (`netconf`) if it was not valid JSON. It also read and printed the contents of the generated CNI configuration file. Both of these could expose sensitive credentials present in the configuration. The patch removes this logging.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.