Tigera Logo

Security Bulletins

ServiceAccount token disclosure via install-cni container logs

Description Severity Notes

ServiceAccount token disclosure via install-cni container logs

Reference: TTA-2026-001, CVE-2026-41184

Date published: May 27, 2026

 Medium N/A

Summary

In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal / Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.

Severity

CVSSv4.0: 6.0 (Medium)

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L

The bearer token written to stdout is the live Kubernetes ServiceAccount JWT mounted into the install-cni container. Once disclosed, it grants patch permission on pods/status cluster-wide, which enables annotation-based attacks (for example, redirecting workloads through attacker-controlled webhooks or sidecars).

References

Weakness Enumeration

CWE-532: Insertion of Sensitive Information into Log File

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Impact

CAPEC-150: Collect Data from Common Resource Locations

Indicators of Impact/Compromise

Review the install-cni init container stdout logs in the namespace where calico-node is deployed; a vulnerable substitution will show the rendered netconf with a JWT in place of __SERVICEACCOUNT_TOKEN__. Audit the kube-apiserver audit log for unexpected pods/status operations issued by the calico-cni ServiceAccount.

Workaround/Mitigation

Restrict pods/log access on the calico-node DaemonSet to the minimum set of principals, and rotate the affected Kubernetes ServiceAccount token. Upgrade to a fixed version as soon as possible.

Affected Releases

  • Calico Open Source
    • All releases prior to v3.31.6 (the v3.31 line up to and including v3.31.5, plus all earlier minor versions)

Fixed Versions

  • Calico Open Source
    • v3.31.6
    • v3.32.0

Acknowledgments

We would like to thank the following individuals:

  • Behnam Shobiri — Finder and Remediation Developer
  • Anthony Tam — Remediation Reviewer
  • Matt Dupre — Remediation Reviewer
  • Casey Davenport — Remediation Verifier
Return to List
X