CVE-2026-41185 is a CWE-532 vulnerability in Tigera Calico when used with the Azure IPAM plugin. The Calico CNI binary mutates incoming CNI configuration data to include subnet information and then logs the entire unmarshaled configuration map at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation. When Kubernetes clusters use token-based authentication, this log contains sensitive credentials such as the ServiceAccount token, client key, and certificate authority in plaintext. Any principal with read access to this log file on a node can extract these credentials, which provide cluster-wide Calico networking administrative privileges. The vulnerability has a CVSS 4.0 score of 6.0 (medium severity). The product is a cloud service, and the vendor manages remediation.

Exposure of sensitive Kubernetes authentication credentials in plaintext logs allows an attacker with read access to the Calico CNI log file on a node to obtain ServiceAccount tokens and client certificates. This can lead to unauthorized cluster-wide Calico networking administrative access, potentially enabling further compromise or disruption of cluster networking.

The vendor manages remediation for this cloud-hosted service. A patch is available, and users should consult the vendor advisory for current remediation guidance. Since this is a cloud service, the vendor typically applies fixes server-side. Users should verify with Tigera that their environment has been updated to prevent sensitive information from being logged.