Calico (Privilegieneskalation) Schwachstelle in github.com/projectcalico/calico

Successful exploitation of CVE-2024-33522 could enable an attacker to bypass Calico's security controls and gain unauthorized access to network resources. This could manifest as the ability to modify network policies, intercept traffic, or even compromise the underlying Kubernetes cluster where Calico is deployed. The potential blast radius is significant, as a compromised Calico instance can impact the entire network it protects. While the specific attack vector remains undisclosed, the privilege escalation nature suggests a sophisticated attacker with a deep understanding of Calico's internal workings would be required.

Organizations heavily reliant on Calico for network security and segmentation are at increased risk. This includes those deploying Calico in Kubernetes environments, cloud-native applications, and zero-trust network architectures. Specifically, deployments using older versions of Calico (prior to 3.26.5 and 3.27.3) are directly vulnerable.

• linux / server:

journalctl -u calico-node --since "1 hour ago" | grep -i "error"

• linux / server:

ps aux | grep calico-node

• generic web:

curl -I <calico_api_endpoint>

• generic web:

cat /var/log/nginx/access.log | grep "/api/v3"

1. 2024-06-10Disclosure

   disclosure

1. Reserviert2024-04-23
2. Veröffentlicht2024-06-10
3. Geändert2026-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-33522 is to upgrade Calico to version 3.26.5 or later. If an immediate upgrade is not possible due to compatibility constraints or testing requirements, consider implementing stricter access controls and network segmentation to limit the potential impact of a successful exploit. Monitor Calico logs for any suspicious activity, particularly related to privilege elevation attempts. While no specific WAF rules or detection signatures are currently available, reviewing Calico's internal audit logs for unusual permission changes is recommended. After upgrading, confirm the fix by verifying the Calico version and checking for any unexpected changes to network policies.