When calicoctl is run with the --log-level set to info or debug, it logs the entire connection-configuration struct to stderr in a single line. This struct contains all credentials used by calicoctl to communicate with the cluster, such as inline kubeconfig with bearer tokens, Kubernetes API bearer tokens, etcd passwords, and PEM-encoded etcd client certificates and keys. Any entity with access to the stderr output—such as CI logs, session recordings, support transcripts, or local host files—can extract these credentials without requiring Kubernetes privileges. The default log level is panic, so this leakage only occurs if verbose logging is deliberately enabled.

Exposure of sensitive cluster credentials through verbose logging can lead to unauthorized access to the Kubernetes cluster and etcd datastore if an attacker can access the stderr output. This can compromise cluster security and confidentiality of sensitive data. However, exploitation requires that verbose logging be enabled and that an attacker has access to the stderr logs or their storage locations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running calicoctl with --log-level=info or --log-level=debug in environments where stderr output may be accessible to unauthorized parties. Restrict access to logs and session recordings that may contain this sensitive information.