---
title: "Security Bulletins – TTA-2026-006, CVE-2026-41187"
source: "https://wordpress-1075849-4005834.cloudwaysapps.com/security-bulletins/tta-2026-006/"
---

# Security Bulletins

Calico Tier Authorization Bypass via DeleteCollection

Description
Severity
Notes

## Calico Tier Authorization Bypass via DeleteCollection

Reference: TTA-2026-006, CVE-2026-41187

Date published: July 30, 2026

Medium
N/A

### Summary

Calico’s apiserver wraps tier-scoped resources so that every operation runs through `AuthorizeTierOperation`, but the `Delete` override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for `DeleteCollection` requests. A user holding the `deletecollection` verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

### Severity

CVSSv4.0: 6.2 (Medium)

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H

Exploitation requires an authenticated user with `deletecollection` (or wildcard) verbs on tier-scoped policy resources. The bypass is an integrity/availability issue: an attacker can destroy policy enforcement in tiers they are not authorized to manage.

### References

- [https://github.com/projectcalico/calico/pull/12731](https://github.com/projectcalico/calico/pull/12731)

- [https://github.com/projectcalico/calico/pull/12735](https://github.com/projectcalico/calico/pull/12735)

- [https://github.com/projectcalico/calico/pull/12736](https://github.com/projectcalico/calico/pull/12736)

- [https://github.com/projectcalico/calico/pull/12737](https://github.com/projectcalico/calico/pull/12737)

### Weakness Enumeration

[CWE-285](https://cwe.mitre.org/data/definitions/285.html): Improper Authorization

[CWE-863](https://cwe.mitre.org/data/definitions/863.html): Incorrect Authorization

### Indicators of Impact/Compromise

- `DeleteCollection` requests against NetworkPolicy / GlobalNetworkPolicy (or staged variants) affecting tiers a subject is not authorized to manage.

- Unexpected disappearance of policies performed by a subject without per-tier authorization.

### Workaround/Mitigation

Do not grant the `deletecollection` verb, or wildcard `["*"]` verbs, on tier-scoped policy resources to users who should not be able to delete policies across tiers. Upgrade to a fixed version.

### Affected Releases

- Calico Open Source - All versions prior to v3.31.6 - v3.32.0 through prior to v3.32.1

- Calico Enterprise - All versions prior to v3.21.7 - v3.22.0 through prior to v3.22.5

- Calico Cloud - All versions prior to v22.4.0

### Fixed Versions

- Calico Open Source - v3.31.6 - v3.32.1

- Calico Enterprise - v3.21.7 - v3.22.5

- Calico Cloud - v22.4.0 and later

### Acknowledgments

We would like to thank the following individuals:

- Behnam Shobiri — Finder

- Mazdak Nasab — Remediation Developer

- Anthony Tam — Remediation Reviewer

- Matt Dupre — Remediation Reviewer

[Return to List](https://wordpress-1075849-4005834.cloudwaysapps.com/security-bulletins/)

<!-- plugin=object-cache-pro client=phpredis metric#hits=5792 metric#misses=17 metric#hit-ratio=99.7 metric#bytes=2003478 metric#prefetches=0 metric#store-reads=390 metric#store-writes=15 metric#store-hits=388 metric#store-misses=6 metric#sql-queries=31 metric#ms-total=967.49 metric#ms-cache=56.21 metric#ms-cache-avg=0.1391 metric#ms-cache-ratio=5.8 sample#redis-hits=73558187 sample#redis-misses=9014363 sample#redis-hit-ratio=89.1 sample#redis-ops-per-sec=254 sample#redis-evicted-keys=0 sample#redis-used-memory=103513288 sample#redis-used-memory-rss=104120320 sample#redis-memory-fragmentation-ratio=1.0 sample#redis-connected-clients=1 sample#redis-tracking-clients=0 sample#redis-rejected-connections=0 sample#redis-keys=16681 -->