The vulnerability arises from Calico's shared debug server when enabled, which binds the Go pprof debug listener to all network interfaces (0.0.0.0) without any authentication mechanism. This exposes runtime diagnostic data including process heap memory, goroutine stacks with function arguments, and command-line arguments to any pod that can reach the listener over the network. Since the heap may contain sensitive information depending on the process state, this can lead to information disclosure. The debug server is opt-in and disabled by default, but when enabled, it is inherently insecure due to lack of authentication and no option to restrict to localhost binding.

An attacker with network access to the debug listener can retrieve sensitive runtime information from the affected Calico components, potentially exposing confidential data stored in memory. This information disclosure could aid further attacks or leak sensitive operational details. The vulnerability does not allow direct code execution or privilege escalation but poses a significant confidentiality risk.

The debug server is disabled by default and should remain so unless absolutely necessary. If enabling the debug server, restrict network access to trusted pods only, as the listener provides no authentication or safe localhost-only binding option. There is no official fix or patch currently available; therefore, users should avoid enabling the shared debug server or implement network-level controls to limit access. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.