CVE-2026-6540

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

• CWE-22
• CWE-23

• https://github.com/projectcalico/calico/pull/12531Issue Tracking, Patch
• https://github.com/projectcalico/calico/pull/12532Issue Tracking, Patch
• https://github.com/projectcalico/calico/pull/12533Issue Tracking, Patch
• https://www.tigera.io/security-bulletins/tta-2026-005/Vendor Advisory

Published

Jul 30, 2026

Last Modified

Aug 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65390An integer overflow was addressed with improved input valida…8.8
• CVE-2026-65391An out-of-bounds write issue was addressed with improved bou…8.8
• CVE-2026-65393A permissions issue was addressed with improved validation. …5.5
• CVE-2026-65395An out-of-bounds write issue was addressed with improved bou…6.5
• CVE-2026-65398An out-of-bounds access issue was addressed with improved bo…7.8
• CVE-2026-65399A file quarantine bypass was addressed with additional check…4.4
• CVE-2026-65400An authentication issue was addressed with improved state ma…9.8
• CVE-2026-65401A race condition was addressed with improved state handling.…5.5
• CVE-2026-65402A use after free issue was addressed with improved memory ma…5.5
• CVE-2026-65403This issue was addressed with improved checks. This issue is…5.5
• CVE-2026-65404An authorization issue was addressed with improved state man…5.5
• CVE-2026-65405A memory initialization issue was addressed with improved me…5.5