---
title: "Security Bulletins – TTA-2026-001, CVE-2026-41184"
source: "https://wordpress-1075849-4005834.cloudwaysapps.com/security-bulletins/tta-2026-001/"
---

# Security Bulletins

ServiceAccount token disclosure via install-cni container logs

Description
Severity
Notes

## ServiceAccount token disclosure via install-cni container logs

Reference: TTA-2026-001, CVE-2026-41184

Date published: May 27, 2026

Medium
N/A

### Summary

In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal / Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.

### Severity

CVSSv4.0: 6.0 (Medium)

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L

The bearer token written to stdout is the live Kubernetes ServiceAccount JWT mounted into the install-cni container. Once disclosed, it grants patch permission on pods/status cluster-wide, which enables annotation-based attacks (for example, redirecting workloads through attacker-controlled webhooks or sidecars).

### References

- [https://github.com/projectcalico/calico/pull/12502](https://github.com/projectcalico/calico/pull/12502)

- [https://github.com/projectcalico/calico/pull/12527](https://github.com/projectcalico/calico/pull/12527)

- [https://github.com/projectcalico/calico/pull/12526](https://github.com/projectcalico/calico/pull/12526)

### Weakness Enumeration

[CWE-532](https://cwe.mitre.org/data/definitions/532.html): Insertion of Sensitive Information into Log File

[CWE-200](https://cwe.mitre.org/data/definitions/200.html): Exposure of Sensitive Information to an Unauthorized Actor

### Impact

[CAPEC-150](https://capec.mitre.org/data/definitions/150.html): Collect Data from Common Resource Locations

### Indicators of Impact/Compromise

Review the install-cni init container stdout logs in the namespace where calico-node is deployed; a vulnerable substitution will show the rendered netconf with a JWT in place of __SERVICEACCOUNT_TOKEN__. Audit the kube-apiserver audit log for unexpected pods/status operations issued by the calico-cni ServiceAccount.

### Workaround/Mitigation

Restrict pods/log access on the calico-node DaemonSet to the minimum set of principals, and rotate the affected Kubernetes ServiceAccount token. Upgrade to a fixed version as soon as possible.

### Affected Releases

- Calico Open Source - All releases prior to v3.31.6 (the v3.31 line up to and including v3.31.5, plus all earlier minor versions)

### Fixed Versions

- Calico Open Source - v3.31.6 - v3.32.0

### Acknowledgments

We would like to thank the following individuals:

- Behnam Shobiri — Finder and Remediation Developer

- Anthony Tam — Remediation Reviewer

- Matt Dupre — Remediation Reviewer

- Casey Davenport — Remediation Verifier

[Return to List](https://wordpress-1075849-4005834.cloudwaysapps.com/security-bulletins/)

<!-- plugin=object-cache-pro client=phpredis metric#hits=5792 metric#misses=17 metric#hit-ratio=99.7 metric#bytes=2004062 metric#prefetches=0 metric#store-reads=390 metric#store-writes=15 metric#store-hits=388 metric#store-misses=6 metric#sql-queries=31 metric#ms-total=1128.72 metric#ms-cache=70.69 metric#ms-cache-avg=0.1750 metric#ms-cache-ratio=6.3 sample#redis-hits=73416438 sample#redis-misses=9009733 sample#redis-hit-ratio=89.1 sample#redis-ops-per-sec=252 sample#redis-evicted-keys=0 sample#redis-used-memory=101717392 sample#redis-used-memory-rss=103583744 sample#redis-memory-fragmentation-ratio=1.0 sample#redis-connected-clients=1 sample#redis-tracking-clients=0 sample#redis-rejected-connections=0 sample#redis-keys=14638 -->