Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/projectcalico/calico(Go) | 3.22.0 | 3.22.2 | N/A |
| github.com/projectcalico/calico(Go) | 3.21.0 | 3.21.5 | N/A |
| github.com/projectcalico/calico(Go) | 0 | 3.20.5 | N/A |
CVSS Metrics
