CVE-2026-41184

The record

In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.

Affected packages

Related vulnerabilities

• CVE-2026-16648 Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log… CWE-532
• CVE-2026-104872 OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting… CWE-532
• CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-532
• CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in its error… CWE-532
• CVE-2026-80169 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-532
• CVE-2026-79966 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-532
• CVE-2026-86597 Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC… CWE-532
• CVE-2026-86501 In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to… CWE-532