CVE-2026-41187 — Calico Tier Authorization Bypass via DeleteCollection
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and th…
Published: 2026-07-30 · CVSS: 6.2 · CVSS 4.0
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7