How many Tigera Calico CVEs are in CISA KEV?

None of Tigera Calico's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for Tigera Calico vulnerabilities?

Yes — 1 of Tigera Calico's CVEs have a known public exploit.

Which versions of Tigera Calico are affected?

59 distinct Tigera Calico versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Tigera Calico CVEs?

Tigera Calico's CVEs most often map to these CWE weakness types: CWE-532 (Insertion of Sensitive Information into Log File), CWE-201 (Insertion of Sensitive Information Into Sent Data), CWE-269 (Improper Privilege Management), CWE-703 (Improper Check or Handling of Exceptional Conditions).

What is the average severity of Tigera Calico CVEs?

The average CVSS base score across Tigera Calico's scored CVEs is 6.7.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Tigera

7 CVEs

Tigera Calico Vulnerabilities

Name: Tigera Calico vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Calico by Tigera.

7

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

1

Public exploits

PoC or exploit code

6.7

Avg CVSS

2020–2026

Last updated May 28, 2026

Overview

Tigera Calico has 7 published CVE records since 2020, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Tigera Calico, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Tigera Calico's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High3

Medium4

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Tigera Calico's CVEs are currently listed in CISA's KEV catalog.

Public exploits

1

One of Tigera Calico's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every Tigera Calico version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

1.5.x1 CVE
1.6.x1 CVE
2.0.x1 CVE
2.1.x1 CVE
2.2.x1 CVE
2.3.x1 CVE
2.4.x1 CVE
2.5.x1 CVE
2.6.x1 CVE
3.0.x1 CVE
3.1.x1 CVE
3.14.01 CVE
3.2.x1 CVE
3.3.x1 CVE
3.4.x1 CVE
3.5.x1 CVE
3.6.x1 CVE
3.7.x1 CVE

Version ranges

< 3.32.03 CVEs
< 22.4.02 CVEs
< 3.21.72 CVEs
3.22.0 <= v < 3.22.32 CVEs
< 3.20.51 CVE
< 3.31.61 CVE
< v3.26.51 CVE
<= 3.10.31 CVE
<= 3.11.21 CVE
<= 3.12.11 CVE
<= 3.13.31 CVE
<= 3.8.81 CVE
<= 3.9.51 CVE
<= v3.15.31 CVE

Fixed in

3.32.03 CVEs
22.4.02 CVEs
3.21.72 CVEs
3.22.32 CVEs
> 3.10.31 CVE
> 3.11.21 CVE
> 3.12.11 CVE
> 3.13.31 CVE
> 3.8.81 CVE
> 3.9.51 CVE
> v3.15.31 CVE
> v3.16.31 CVE
> v3.17.11 CVE
3.20.51 CVE

Find a version

7 CVEs

Sort

ServiceAccount token disclosure via Azure IPAM CNI plugin logs
CVE-2026-41185
Patch
CWE-532
Medium · CVSS 6.0
EPSS 0.3% (25th pct)2026-05-28
Calicoctl leaks cluster credentials to stderr when verbose logging is enabled
CVE-2026-6720
Patch
CWE-532
High · CVSS 7.2
EPSS 0.2% (13th pct)2026-05-28
ServiceAccount token disclosure via install-cni container logs
CVE-2026-41184
Patch
CWE-532
Medium · CVSS 6.0
EPSS 0.5% (40th pct)2026-05-28
High vulnerability · 2024-04-29
CVE-2024-33522
Public exploit
Patch
CWE-269
High · CVSS 8.6
EPSS 0.2% (13th pct)2024-04-29
Calico Typha hangs during unclean TLS handshake
CVE-2023-41378
Patch
CWE-703
High · CVSS 7.5
EPSS 0.7% (50th pct)2023-11-06
Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
CVE-2022-28224
Patch
CWE-201
Medium · CVSS 5.5
EPSS 0.6% (43th pct)2022-06-06
Medium vulnerability · 2020-06-03
CVE-2020-13597
Patch
CWE-201
Medium · CVSS 6.0
EPSS 0.9% (56th pct)2020-06-03

Common weakness types

The CWE weakness categories most often found in Tigera Calico CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Tigera Calico CVEs were published each year.

2020

1

2022

1

2023

1

2024

1

2026

3

Other Tigera products

Browse vulnerabilities for other products by Tigera.

Calico Enterprise6 CVEs Calico Cloud4 CVEs calico os1 CVEs Typha1 CVEs

All Tigera vulnerabilities

Frequently asked questions

Common questions about Tigera Calico vulnerabilities.

How many CVEs does Tigera Calico have?: Tigera Calico has 7 published CVE records since 2020.
How many Tigera Calico CVEs are in CISA KEV?: None of Tigera Calico's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Tigera Calico vulnerabilities?: Yes — 1 of Tigera Calico's CVEs have a known public exploit.
Which versions of Tigera Calico are affected?: 59 distinct Tigera Calico versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Tigera Calico CVEs?: Tigera Calico's CVEs most often map to these CWE weakness types: CWE-532 (Insertion of Sensitive Information into Log File), CWE-201 (Insertion of Sensitive Information Into Sent Data), CWE-269 (Improper Privilege Management), CWE-703 (Improper Check or Handling of Exceptional Conditions).
What is the average severity of Tigera Calico CVEs?: The average CVSS base score across Tigera Calico's scored CVEs is 6.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Tigera Calico vulnerabilities

Monitor new Tigera Calico vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

>= 3.32.0

1 CVE

>= v3.28.01 CVE

3.21.0 <= v < 3.21.51 CVE

3.22.0 <= v < 3.22.21 CVE

v3.16.0 <= v <= v3.16.31 CVE

v3.17.0 <= v <= v3.17.11 CVE

v3.27.0 <= v < v3.27.31 CVE

3.21.5

1 CVE

3.22.21 CVE

3.31.61 CVE

v3.26.51 CVE

v3.27.31 CVE

v3.28.01 CVE