CVE-2022-28224 Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
A privileged attacker can hijack routes by setting floating IP annotations on pods, allowing traffic interception even when the feature is disabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-28224?
CVE-2022-28224 is a medium-severity missing authorization vulnerability in Project Calico Calico, published on 6 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
Which versions are affected by CVE-2022-28224?
6 open source packages ship an affected version, including github.com/projectcalico/calico. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcalico/calico Go | All versions | 3.20.5 |
github.com/projectcalico/calico Go | All versions | 3.20.5 |
github.com/projectcalico/calico Go | From 3.21.0 | 3.21.5 |
github.com/projectcalico/calico Go | From 3.21.0 | 3.21.5 |
github.com/projectcalico/calico Go | From 3.22.0 | 3.22.2 |
github.com/projectcalico/calico Go | From 3.22.0 | 3.22.2 |
Products include Tigera Calico, Tigera Calico Enterprise.
How do I fix CVE-2022-28224?
Upgrade github.com/projectcalico/calico to a fixed version for your release line: 3.20.5, 3.21.5 or 3.22.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-28224 being exploited?
There is no known exploitation of CVE-2022-28224 in the wild and no public exploit code.
Other vulnerabilities in Project Calico Calico
- CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching
- CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection
- CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server
- CVE-2026-41184 ServiceAccount token disclosure via install-cni container logs
- CVE-2026-41185 ServiceAccount token disclosure via Azure IPAM CNI plugin logs
Sources
Also known as GHSA-9394-xfq9-6qrp.