{"answers":{"affected":"4 open source packages ship an affected version, including github.com/projectcalico/calicoctl/v3 and github.com/projectcalico/calicoctl.","exploited":"There is no known exploitation of CVE-2026-6720 in the wild and no public exploit code.","fix":"Upgrade github.com/projectcalico/calicoctl/v3 to 3.31.6 or later.","what":"CVE-2026-6720 is a high-severity vulnerability in Tigera Calico, published on 28 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-6720 and fix it if it is affected.\n\nWhat it is: CVE-2026-6720 is a high-severity vulnerability in Tigera Calico, published on 28 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-6720 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/projectcalico/calicoctl/v3 (Go): affected all versions; no fix listed\n- github.com/projectcalico/calicoctl/v3 (Go): affected all versions; fixed in 3.31.6\n- github.com/projectcalico/calicoctl/v3 (Go): affected all versions; fixed in 3.31.6\n- github.com/projectcalico/calicoctl (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-6720/ (Markdown: https://insights.sbomify.com/CVE-2026-6720/index.md)","id":"CVE-2026-6720","markdown":"https://insights.sbomify.com/CVE-2026-6720/index.md","name":"CVE-2026-6720","record":{"aliases":["GHSA-3m4q-ggcj-j6m4","GO-2026-5893","MINI-4h7j-2gxm-3gmm","MINI-6c4p-j525-45g7","MINI-7q5c-x246-w3j5","MINI-f3j5-7582-cp6g","MINI-fqcf-jgvg-65jf","MINI-gcpq-h7j4-6cmx","MINI-grvr-hv8m-2255","MINI-m5x2-4vf2-52gr","MINI-xmmw-rxjh-c9j2"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"patch","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Calico network plugin","requires_auth":"low_privilege","summary":"Verbose logging in calicoctl exposes cluster credentials to stderr, allowing attackers with log access to steal tokens and keys.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Tigera","cpe":[],"cvss":{"score":7.2,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"description":"When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Calicoctl leaks cluster credentials to stderr when verbose logging is enabled","id":"CVE-2026-6720","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":4,"n_references":4,"next":{"headline":"Multiple Vulnerabilities in IBM Concert Software","id":"CVE-2026-6721"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/projectcalico/calicoctl","purl":"pkg:golang/github.com/projectcalico/calicoctl","source":"GO-2026-5893"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/projectcalico/calicoctl/v3","purl":"pkg:golang/github.com/projectcalico/calicoctl/v3","source":"GO-2026-5893"},{"ecosystem":"Go","fixed":["3.31.6"],"introduced":["0"],"last_affected":[],"package":"github.com/projectcalico/calicoctl/v3","purl":null,"source":"GHSA-3m4q-ggcj-j6m4"},{"ecosystem":"Go","fixed":["3.31.6"],"introduced":["0"],"last_affected":[],"package":"github.com/projectcalico/calicoctl/v3","purl":"pkg:golang/github.com/projectcalico/calicoctl/v3","source":"GHSA-3m4q-ggcj-j6m4"}],"prev":{"headline":"IBM Concert Software Use of Insufficiently Random Values","id":"CVE-2026-6719"},"products":["Calico","Calico Cloud","Calico Enterprise"],"published":"2026-05-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-28","vendors":["Tigera"]},"summary":"Verbose logging in calicoctl exposes cluster credentials to stderr, allowing attackers with log access to steal tokens and keys.","url":"https://insights.sbomify.com/CVE-2026-6720/"}