When calicoctl is run with the --log-level set to info or debug, it outputs the full connection-configuration struct to stderr in a single log line. This struct contains all credentials used by calicoctl to communicate with the cluster, including inline kubeconfig with bearer tokens, Kubernetes API bearer tokens, etcd passwords, and PEM-encoded etcd client certificates and keys. Any entity with access to the stderr stream can extract these credentials without needing Kubernetes privileges. The vulnerability is categorized under CWE-532 (Information Exposure Through Log Files) and has a CVSS 4.0 base score of 7.2 (high severity). There is no vendor advisory or patch information available at this time.

Exposure of sensitive cluster credentials through verbose logging can lead to unauthorized access to Kubernetes cluster resources and etcd data if an attacker or unauthorized user can access the stderr output. This can compromise cluster confidentiality and integrity. However, exploitation requires that verbose logging be explicitly enabled and that the attacker has access to the stderr stream or logs containing it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running calicoctl with --log-level=info or --log-level=debug in environments where stderr output can be accessed by untrusted parties. Restrict access to logs and CI job outputs that may contain calicoctl stderr output. Use the default log level (panic) unless verbose logging is necessary and secure.