--- title: "Security Bulletins – TTA-2026-006, CVE-2026-41187" source: "https://www.tigera.io/security-bulletins/tta-2026-006/" --- # Security Bulletins Calico Tier Authorization Bypass via DeleteCollection Description Severity Notes ## Calico Tier Authorization Bypass via DeleteCollection Reference: TTA-2026-006, CVE-2026-41187 Date published: July 30, 2026 Medium N/A ### Summary Calico’s apiserver wraps tier-scoped resources so that every operation runs through `AuthorizeTierOperation`, but the `Delete` override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for `DeleteCollection` requests. A user holding the `deletecollection` verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary. ### Severity CVSSv4.0: 6.2 (Medium) Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H Exploitation requires an authenticated user with `deletecollection` (or wildcard) verbs on tier-scoped policy resources. The bypass is an integrity/availability issue: an attacker can destroy policy enforcement in tiers they are not authorized to manage. ### References - [https://github.com/projectcalico/calico/pull/12731](https://github.com/projectcalico/calico/pull/12731) - [https://github.com/projectcalico/calico/pull/12735](https://github.com/projectcalico/calico/pull/12735) - [https://github.com/projectcalico/calico/pull/12736](https://github.com/projectcalico/calico/pull/12736) - [https://github.com/projectcalico/calico/pull/12737](https://github.com/projectcalico/calico/pull/12737) ### Weakness Enumeration [CWE-285](https://cwe.mitre.org/data/definitions/285.html): Improper Authorization [CWE-863](https://cwe.mitre.org/data/definitions/863.html): Incorrect Authorization ### Indicators of Impact/Compromise - `DeleteCollection` requests against NetworkPolicy / GlobalNetworkPolicy (or staged variants) affecting tiers a subject is not authorized to manage. - Unexpected disappearance of policies performed by a subject without per-tier authorization. ### Workaround/Mitigation Do not grant the `deletecollection` verb, or wildcard `["*"]` verbs, on tier-scoped policy resources to users who should not be able to delete policies across tiers. Upgrade to a fixed version. ### Affected Releases - Calico Open Source - All versions prior to v3.31.6 - v3.32.0 through prior to v3.32.1 - Calico Enterprise - All versions prior to v3.21.7 - v3.22.0 through prior to v3.22.5 - Calico Cloud - All versions prior to v22.4.0 ### Fixed Versions - Calico Open Source - v3.31.6 - v3.32.1 - Calico Enterprise - v3.21.7 - v3.22.5 - Calico Cloud - v22.4.0 and later ### Acknowledgments We would like to thank the following individuals: - Behnam Shobiri — Finder - Mazdak Nasab — Remediation Developer - Anthony Tam — Remediation Reviewer - Matt Dupre — Remediation Reviewer [Return to List](https://www.tigera.io/security-bulletins/)