CVE-2026-6720 Calicoctl leaks cluster credentials to stderr when verbose logging is enabled
Verbose logging in calicoctl exposes cluster credentials to stderr, allowing attackers with log access to steal tokens and keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-6720?
CVE-2026-6720 is a high-severity vulnerability in Tigera Calico, published on 28 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.
Weakness: CWE-532
Which versions are affected by CVE-2026-6720?
4 open source packages ship an affected version, including github.com/projectcalico/calicoctl/v3 and github.com/projectcalico/calicoctl.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcalico/calicoctl/v3 Go | All versions | None |
github.com/projectcalico/calicoctl/v3 Go | All versions | 3.31.6 |
github.com/projectcalico/calicoctl/v3 Go | All versions | 3.31.6 |
github.com/projectcalico/calicoctl Go | All versions | None |
How do I fix CVE-2026-6720?
Upgrade github.com/projectcalico/calicoctl/v3 to 3.31.6 or later.
Is CVE-2026-6720 being exploited?
There is no known exploitation of CVE-2026-6720 in the wild and no public exploit code.
Sources
Also known as GHSA-3m4q-ggcj-j6m4, GO-2026-5893, MINI-4h7j-2gxm-3gmm, MINI-6c4p-j525-45g7, MINI-7q5c-x246-w3j5, MINI-f3j5-7582-cp6g and 5 more.