Tigera Calico's Application Layer Policy, when enabled, enforces HTTP rules via Dikastes. However, Dikastes fails to normalize URL paths, leading to improper evaluation of prefix path rules when requests contain path traversal segments, encoded slashes, or repeated slashes. Consequently, Dikastes may authorize requests based on the unnormalized path, while downstream components normalize the path and serve restricted endpoints. This discrepancy enables an attacker with network access and no special RBAC permissions to reach HTTP endpoints intended to be restricted by the policy.

An attacker with network access can exploit this vulnerability to bypass HTTP path restrictions enforced by Calico's Application Layer Policy and access restricted HTTP endpoints. This could lead to unauthorized access to sensitive resources or services protected by these policies. No special privileges or user interaction are required, increasing the risk of exploitation. However, the feature is disabled by default, which limits exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the Application Layer Policy is disabled by default, disabling it or ensuring it remains disabled can mitigate risk. Monitor Tigera's official advisories for updates or patches addressing this vulnerability.