---
title: "Security Bulletins – TTA-2026-005, CVE-2026-6540"
source: "https://www.tigera.io/security-bulletins/tta-2026-005/"
---

# Security Bulletins

L7 policy bypass via unnormalized HTTP path matching

Description
Severity
Notes

## L7 policy bypass via unnormalized HTTP path matching

Reference: TTA-2026-005, CVE-2026-6540

Date published: July 30, 2026

High
N/A

### Summary

Calico’s Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by `Prefix` path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

### Severity

CVSSv4.0: 7.9 (High)

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

Exploitation requires no authentication or special position in the network; any HTTP client able to reach an ALP-enabled pod whose Calico L7 rule uses `Prefix` matching can attempt the bypass.

### References

- [https://github.com/projectcalico/calico/pull/12531](https://github.com/projectcalico/calico/pull/12531)

- [https://github.com/projectcalico/calico/pull/12532](https://github.com/projectcalico/calico/pull/12532)

- [https://github.com/projectcalico/calico/pull/12533](https://github.com/projectcalico/calico/pull/12533)

### Weakness Enumeration

[CWE-22](https://cwe.mitre.org/data/definitions/22.html): Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”)

[CWE-23](https://cwe.mitre.org/data/definitions/23.html): Relative Path Traversal

### Indicators of Impact/Compromise

- HTTP requests to ALP-protected workloads containing `../` segments, encoded slashes (`%2F`), or repeated slashes (`//`) in the request path.

- Access to restricted endpoints (e.g. `/admin`) recorded by the upstream workload that was not authorized by the Calico L7 policy.

### Workaround/Mitigation

There is no reliable workaround. Do not rely on `Prefix` L7 path rules as a security boundary until the fix is applied. Upgrade to a fixed version.

### Affected Releases

- Calico Open Source - All versions prior to v3.31.6

- Calico Enterprise - All versions prior to v3.21.7 - v3.22.0 through prior to v3.22.4

- Calico Cloud - All versions prior to v22.4.0

### Fixed Versions

- Calico Open Source - v3.31.6 - v3.32.0

- Calico Enterprise - v3.21.7 - v3.22.4

- Calico Cloud - v22.4.0 and later

### Acknowledgments

We would like to thank the following individuals:

- Behnam Shobiri — Finder

- Seth Malaki — Remediation Developer

- Anthony Tam — Remediation Reviewer

- Matt Dupre — Remediation Reviewer

[Return to List](https://www.tigera.io/security-bulletins/)

<!-- plugin=object-cache-pro client=phpredis metric#hits=2894 metric#misses=37 metric#hit-ratio=98.7 metric#bytes=1300627 metric#prefetches=108 metric#store-reads=43 metric#store-writes=12 metric#store-hits=116 metric#store-misses=26 metric#sql-queries=28 metric#ms-total=612.02 metric#ms-cache=20.31 metric#ms-cache-avg=0.3762 metric#ms-cache-ratio=3.3 -->