---
title: "Security Bulletins – TTA-2026-004, CVE-2026-41186"
source: "https://www.tigera.io/security-bulletins/tta-2026-004/"
---

# Security Bulletins

Unauthenticated Go pprof exposure in Calico debug server

Description
Severity
Notes

## Unauthenticated Go pprof exposure in Calico debug server

Reference: TTA-2026-004, CVE-2026-41186

Date published: July 30, 2026

Medium
N/A

### Summary

When Calico’s shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process’s in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.

### Severity

CVSSv4.0: 6.0 (Medium)

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L

The vulnerability requires an operator to first enable the debug profile port. Once enabled, exploitation requires only network reachability to the listener from within the cluster and no authentication or privileges. Felix and Typha default their debug listeners to localhost and are not affected by this default-unsafe binding.

### References

- [https://github.com/projectcalico/calico/pull/12491](https://github.com/projectcalico/calico/pull/12491)

- [https://github.com/projectcalico/calico/pull/12634](https://github.com/projectcalico/calico/pull/12634)

- [https://github.com/projectcalico/calico/pull/12633](https://github.com/projectcalico/calico/pull/12633)

### Weakness Enumeration

[CWE-489](https://cwe.mitre.org/data/definitions/489.html): Active Debug Code

[CWE-200](https://cwe.mitre.org/data/definitions/200.html): Exposure of Sensitive Information to an Unauthorized Actor

### Indicators of Impact/Compromise

- A `debugProfilePort` (kube-controllers) or `PROFILE_PORT` (Goldmane) value configured in a production deployment.

- Network connections to the kube-controllers or Goldmane pprof port (`/debug/pprof/*`) originating from pods that are not part of the Calico control plane.

- Unexpected use of the `calico-kube-controllers` ServiceAccount token from sources other than the kube-controllers pod.

### Workaround/Mitigation

Do not enable the debug profile port (`debugProfilePort` for kube-controllers, `PROFILE_PORT` for Goldmane) in production. If it is already enabled, disable it. Upgrade to a fixed version.

### Affected Releases

- Calico Open Source - All versions prior to v3.31.6 - v3.32.0 through prior to v3.32.1

- Calico Enterprise - All versions prior to v3.21.7 - v3.22.0 through prior to v3.22.4

- Calico Cloud - All versions prior to v22.4.0

### Fixed Versions

- Calico Open Source - v3.31.6 - v3.32.1

- Calico Enterprise - v3.21.7 - v3.22.4

- Calico Cloud - v22.4.0 and later

### Acknowledgments

We would like to thank the following individuals:

- Behnam Shobiri — Finder, Remediation Developer

- Anthony Tam — Remediation Reviewer

- Matt Dupre — Remediation Reviewer

[Return to List](https://www.tigera.io/security-bulletins/)

<!-- plugin=object-cache-pro client=phpredis metric#hits=2894 metric#misses=35 metric#hit-ratio=98.8 metric#bytes=1300022 metric#prefetches=109 metric#store-reads=42 metric#store-writes=15 metric#store-hits=117 metric#store-misses=24 metric#sql-queries=31 metric#ms-total=546.33 metric#ms-cache=19.00 metric#ms-cache-avg=0.3394 metric#ms-cache-ratio=3.5 sample#redis-hits=34663715 sample#redis-misses=9713798 sample#redis-hit-ratio=78.1 sample#redis-ops-per-sec=32 sample#redis-evicted-keys=0 sample#redis-used-memory=143813512 sample#redis-used-memory-rss=118235136 sample#redis-memory-fragmentation-ratio=0.8 sample#redis-connected-clients=1 sample#redis-tracking-clients=0 sample#redis-rejected-connections=0 sample#redis-keys=132098 -->