Homepage

CVE-2026-6720 Affecting calico-3.29-cni-fips package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.22% (13th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-CALICO329CNIFIPS-17351801
  • published17 Jun 2026
  • disclosed28 May 2026
Report a new vulnerability Found a mistake?

Introduced: 28 May 2026

NewCVE-2026-6720  (opens in a new tab)

How to fix?

There is no fixed version for Minimos:latest calico-3.29-cni-fips.

NVD Description

Note: Versions mentioned in the description apply only to the upstream calico-3.29-cni-fips package and not the calico-3.29-cni-fips package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.