CVE-2026-41186

Name of the Vulnerable Software and Affected Versions Calico (affected versions not specified)

Description When the shared debug server is enabled, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. This allows any pod with network reachability to the listener to retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. The process heap may contain sensitive material depending on the in-memory state. The debug listener is an opt-in feature that lacks authentication and a safe localhost-only binding option.

Recommendations Keep the shared debug server disabled. As a temporary mitigation, restrict network access to the debug listener to prevent unauthorized pods from reaching the service.