This vulnerability arises from Calico's shared debug server binding its Go pprof debug listener to all network interfaces (0.0.0.0) without any authentication when enabled. This exposes internal runtime information including process heap memory, goroutine stacks with function arguments, and command-line arguments to any pod that can reach the listener over the network. The heap may contain sensitive data depending on the process's memory state. The debug server is opt-in and disabled by default, but if enabled, it is unsafe due to lack of authentication and no option to restrict binding to localhost only.

An attacker with network access to the debug listener can obtain detailed runtime information from the Calico components, potentially exposing sensitive in-memory data. This can lead to information disclosure that may aid further attacks or compromise confidentiality. The vulnerability does not allow direct code execution or privilege escalation but exposes sensitive internal state.

Since the debug listener is disabled by default, the primary mitigation is to avoid enabling the shared debug server unless absolutely necessary. If enabled, restrict network access to the debug listener to trusted pods only via network policies or firewall rules. There is no official fix or patch currently available; monitor the vendor advisory for updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.