CVE-2026-6540
Last modified
CVE-2026-6540 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tigera | Calico | < 3.21.7 |
| Tigera | Calico | < 3.31.6 |
| Tigera | Calico | <= 22.4.0 |
| Tigera | Calico | >= 3.22.0, < 3.22.4 |
| Tigera | Calico | >= 3.32.0, < 3.32.1 |
References
- https://github.com/projectcalico/calico/pull/12531Issue Tracking, Patch
- https://github.com/projectcalico/calico/pull/12532Issue Tracking, Patch
- https://github.com/projectcalico/calico/pull/12533Issue Tracking, Patch
- https://www.tigera.io/security-bulletins/tta-2026-005/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-6540?
How severe is CVE-2026-6540?
How do I fix CVE-2026-6540?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-6534USB HID protocol dissector infinite loop in Wireshark 4.6.0 …5.5
- CVE-2026-6535Dissection engine zlib decompression crash in Wireshark 4.6.…5.5
- CVE-2026-6536DLMS/COSEM protocol dissector infinite loop in Wireshark 4.6…5.5
- CVE-2026-6537ZigBee protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
- CVE-2026-6538BEEP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 an…5.5
- CVE-2026-6539Notepad++ 8.9.3 contains a format string injection vulnerabi…4.6
- CVE-2026-65400An authentication issue was addressed with improved state ma…7.1
- CVE-2026-6541Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.1…4.3
- CVE-2026-6542IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to…8.1
- CVE-2026-65421The MMS BER decoder contains a flaw in decoding fixed-width …7.1
- CVE-2026-65423An integer overflow in the UA_Variant arrayDimensions produc…8.8
- CVE-2026-6543IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an …8.8
Are you affected by CVE-2026-6540?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST