Tigera Logo

Security Bulletins

L7 policy bypass via unnormalized HTTP path matching

Description Severity Notes

L7 policy bypass via unnormalized HTTP path matching

Reference: TTA-2026-005, CVE-2026-6540

Date published: July 30, 2026

 High N/A

Summary

Calico’s Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

Severity

CVSSv4.0: 7.9 (High)

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

Exploitation requires no authentication or special position in the network; any HTTP client able to reach an ALP-enabled pod whose Calico L7 rule uses Prefix matching can attempt the bypass.

References

Weakness Enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”)

CWE-23: Relative Path Traversal

Indicators of Impact/Compromise

  • HTTP requests to ALP-protected workloads containing ../ segments, encoded slashes (%2F), or repeated slashes (//) in the request path.
  • Access to restricted endpoints (e.g. /admin) recorded by the upstream workload that was not authorized by the Calico L7 policy.

Workaround/Mitigation

There is no reliable workaround. Do not rely on Prefix L7 path rules as a security boundary until the fix is applied. Upgrade to a fixed version.

Affected Releases

  • Calico Open Source
    • All versions prior to v3.31.6
  • Calico Enterprise
    • All versions prior to v3.21.7
    • v3.22.0 through prior to v3.22.4
  • Calico Cloud
    • All versions prior to v22.4.0

Fixed Versions

  • Calico Open Source
    • v3.31.6
    • v3.32.0
  • Calico Enterprise
    • v3.21.7
    • v3.22.4
  • Calico Cloud
    • v22.4.0 and later

Acknowledgments

We would like to thank the following individuals:

  • Behnam Shobiri — Finder
  • Seth Malaki — Remediation Developer
  • Anthony Tam — Remediation Reviewer
  • Matt Dupre — Remediation Reviewer
Return to List
X