Threats tagged 'ghsa-38w4-qxg9-xg36'

CVE-2026-41187 is a medium severity vulnerability in Tigera Calico 3.32.0 involving improper authorization. The issue arises because the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. This allows users with deletecollection or wildcard delete permissions on tier-scoped policy resources to bulk-delete policies in tiers where they do not have explicit rights, breaking the tier authorization boundary.