CVE-2024-33522: Privilege Escalation in Calico

Successful exploitation of CVE-2024-33522 could enable an attacker to bypass Calico's security controls and gain unauthorized access to sensitive network resources. This could manifest as the ability to modify network policies, intercept traffic, or even compromise underlying infrastructure. The exact impact depends on the attacker's existing privileges and the configuration of the Calico deployment. Given Calico's role in enforcing network segmentation and security, a successful privilege escalation could have a significant blast radius, potentially affecting multiple workloads and services within the network. While the specific attack vector remains undisclosed, the potential for privilege escalation warrants immediate attention and remediation.

1. Reserved2024-04-23
2. Published2024-06-10
3. Modified2026-02-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-33522 is to upgrade Calico to version 3.26.5 or later. Before upgrading, review the Calico release notes for any potential breaking changes and test the upgrade in a non-production environment. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to Calico API endpoints or implementing stricter authentication and authorization policies. Monitor Calico logs for any suspicious activity related to privilege escalation attempts. After upgrading, confirm the fix by verifying that the affected versions are no longer present and that the Calico API is functioning as expected.