products / calico

Calico

Calico is a cloud-native networking and network security CNI for Kubernetes. It provides pod networking, network policy enforcement, and optional BGP for bare-metal and hybrid clusters. NVD tracks the product primarily as projectcalico:calico (and related Tigera vendor strings on newer records). It is a common alternative to Cilium on clusters that prefer an iptables or eBPF policy model without Hubble.

api usage

Querying Calico

product slugcalico

version format3.28.0, 3.14.0, 3.22.1

bash

curl "https://api.attestd.io/v1/check?product=calico&version=3.14.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Calico 3.14.0 is affected by CVE-2020-13597 (IPv6 route advertisement allows traffic redirection when IPv6 is enabled but unused). The aggregated response shows a non- none risk_state.

json

{
  "product": "calico",
  "version": "3.14.0",
  "supported": true,
  "risk_state": "elevated",
  "risk_factors": [
    "remote_code_execution",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": true,
  "patch_available": true,
  "fixed_version": "3.31.6",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2020-13597",
    "CVE-2026-41186",
    "CVE-2026-41187",
    "CVE-2026-6540"
  ],
  "cves": null,
  "max_epss": 0.00902,
  "last_updated": "2026-07-30T17:45:36.884150Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Calico 3.28.0 sits past the floating-IP route-hijack fixes on the 3.20 through 3.22 trains and is a current stable line for new clusters.

bash

curl "https://api.attestd.io/v1/check?product=calico&version=3.28.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

NVD application-layer coverage for Calico is sparse compared with Cilium or Envoy. Only a handful of CVEs map cleanly to the Calico CPE family. Documented issues focus on privileged routing and CNI install/IPAM path handling rather than a long stream of remote RCE advisories. The table below lists the NVD-tracked Calico rows that matter for operators; volume stays low even as cluster adoption remains high.

CVE	Description	Affects	CVSS
`CVE-2026-41185`	Azure IPAM CNI path mutates CNI config before delegation and can leak or alter network config handling.	branch cuts	6.5
`CVE-2026-41184`	install-cni logs rendered CNI config including service-account token placeholder values.	branch cuts	6.5
`CVE-2022-28224`	Insufficient floating-IP validation enables privileged route hijacking.	<3.20.5 / ≥3.21.0 <3.21.5 / ≥3.22.0 <3.22.2	5.5

data sources

Project Calico CPE namespace

Most historical Calico CVEs land under the Project Calico vendor string. Newer Tigera-tagged records still describe the same CNI product family. Attestd maps the calico slug onto those CPE strings and merges on CVE ID.

cpe:2.3:a:projectcalico:calicoPrimary NVD product identifier

Sparse NVD volume does not mean Calico is unused. It means operators should treat each published Calico CVE as high signal and keep the CNI version aligned with the patched branch for their minor train.

All products Cilium Istio Quickstart