Tigera Logo

Security Bulletins

Unauthenticated Go pprof exposure in Calico debug server

Description Severity Notes

Unauthenticated Go pprof exposure in Calico debug server

Reference: TTA-2026-004, CVE-2026-41186

Date published: July 30, 2026

 Medium N/A

Summary

When Calico’s shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process’s in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.

Severity

CVSSv4.0: 6.0 (Medium)

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L

The vulnerability requires an operator to first enable the debug profile port. Once enabled, exploitation requires only network reachability to the listener from within the cluster and no authentication or privileges. Felix and Typha default their debug listeners to localhost and are not affected by this default-unsafe binding.

References

Weakness Enumeration

CWE-489: Active Debug Code

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Indicators of Impact/Compromise

  • A debugProfilePort (kube-controllers) or PROFILE_PORT (Goldmane) value configured in a production deployment.
  • Network connections to the kube-controllers or Goldmane pprof port (/debug/pprof/*) originating from pods that are not part of the Calico control plane.
  • Unexpected use of the calico-kube-controllers ServiceAccount token from sources other than the kube-controllers pod.

Workaround/Mitigation

Do not enable the debug profile port (debugProfilePort for kube-controllers, PROFILE_PORT for Goldmane) in production. If it is already enabled, disable it. Upgrade to a fixed version.

Affected Releases

  • Calico Open Source
    • All versions prior to v3.31.6
    • v3.32.0 through prior to v3.32.1
  • Calico Enterprise
    • All versions prior to v3.21.7
    • v3.22.0 through prior to v3.22.4
  • Calico Cloud
    • All versions prior to v22.4.0

Fixed Versions

  • Calico Open Source
    • v3.31.6
    • v3.32.1
  • Calico Enterprise
    • v3.21.7
    • v3.22.4
  • Calico Cloud
    • v22.4.0 and later

Acknowledgments

We would like to thank the following individuals:

  • Behnam Shobiri — Finder, Remediation Developer
  • Anthony Tam — Remediation Reviewer
  • Matt Dupre — Remediation Reviewer
Return to List
X