Vulnerabilidade de escalada de privilégios no Calico em github.com/projectcalico/calico

Successful exploitation of CVE-2024-33522 could enable an attacker to bypass Calico's security controls and gain unauthorized access to sensitive network resources. This could manifest as the ability to modify network policies, intercept traffic, or even compromise underlying infrastructure. The exact impact depends on the attacker's existing privileges and the configuration of the Calico deployment. Given Calico's role in enforcing network segmentation and security, a successful privilege escalation could have a significant blast radius, potentially affecting multiple workloads and services within the network. While the specific attack vector remains undisclosed, the potential for privilege escalation warrants immediate attention and remediation.

Organizations heavily reliant on Calico for network security and segmentation are at increased risk. This includes those deploying Calico in Kubernetes environments, cloud-native applications, and zero-trust network architectures. Specifically, deployments using older versions of Calico (prior to 3.26.5 and 3.27.3) are directly vulnerable.

• linux / server:

journalctl -u calico-node --since "1 hour ago" | grep -i "error"

• linux / server:

ps aux | grep calico-node

• generic web:

curl -I <calico_api_endpoint>

• generic web:

cat /var/log/nginx/access.log | grep "/api/v3"

1. 2024-06-10Disclosure

   disclosure

1. Reservado2024-04-23
2. Publicada2024-06-10
3. Modificada2026-02-04
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-33522 is to upgrade Calico to version 3.26.5 or later. Before upgrading, review the Calico release notes for any potential breaking changes and test the upgrade in a non-production environment. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to Calico API endpoints or implementing stricter authentication and authorization policies. Monitor Calico logs for any suspicious activity related to privilege escalation attempts. After upgrading, confirm the fix by verifying that the affected versions are no longer present and that the Calico API is functioning as expected.