Security Bulletins

Summary

Calico’s apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

Severity

CVSSv4.0: 6.2 (Medium)

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H

Exploitation requires an authenticated user with deletecollection (or wildcard) verbs on tier-scoped policy resources. The bypass is an integrity/availability issue: an attacker can destroy policy enforcement in tiers they are not authorized to manage.

References

Weakness Enumeration

CWE-285: Improper Authorization

CWE-863: Incorrect Authorization

Indicators of Impact/Compromise

• DeleteCollection requests against NetworkPolicy / GlobalNetworkPolicy (or staged variants) affecting tiers a subject is not authorized to manage.
• Unexpected disappearance of policies performed by a subject without per-tier authorization.

Workaround/Mitigation

Do not grant the deletecollection verb, or wildcard ["*"] verbs, on tier-scoped policy resources to users who should not be able to delete policies across tiers. Upgrade to a fixed version.

Affected Releases

• Calico Open Source
  • All versions prior to v3.31.6
  • v3.32.0 through prior to v3.32.1
• Calico Enterprise
  • All versions prior to v3.21.7
  • v3.22.0 through prior to v3.22.5
• Calico Cloud
  • All versions prior to v22.4.0

Fixed Versions

• Calico Open Source
  • v3.31.6
  • v3.32.1
• Calico Enterprise
  • v3.21.7
  • v3.22.5
• Calico Cloud
  • v22.4.0 and later

Acknowledgments

We would like to thank the following individuals:

• Behnam Shobiri — Finder
• Mazdak Nasab — Remediation Developer
• Anthony Tam — Remediation Reviewer
• Matt Dupre — Remediation Reviewer