{"id":"CVE-2022-28224","aliases":["GHSA-9394-xfq9-6qrp"],"title":"Calico vulnerable to pod route hijacking","summary":"Calico vulnerable to pod route hijacking","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","vendor":"projectcalico","product":"github.com/projectcalico/calico","ecosystem":"go","affected":["github.com/projectcalico/calico >= 3.22.0, < 3.22.2","github.com/projectcalico/calico >= 3.21.0, < 3.21.5","github.com/projectcalico/calico < 3.20.5"],"patched":["github.com/projectcalico/calico 3.22.2","github.com/projectcalico/calico 3.21.5","github.com/projectcalico/calico 3.20.5"],"published":"2022-06-07","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9394-xfq9-6qrp","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28224"},{"url":"https://github.com/projectcalico/calico"},{"url":"https://www.tigera.io/security-bulletins-tta-2022-001"}],"tags":["osv","go"],"epss":0.00591,"epssPercentile":0.46975,"ingestedAt":"2026-08-07T19:14:16.480Z","slug":"CVE-2022-28224","body":"## Overview\n\nClusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.\n\n## Affected packages\n\n- `github.com/projectcalico/calico >= 3.22.0, < 3.22.2`\n- `github.com/projectcalico/calico >= 3.21.0, < 3.21.5`\n- `github.com/projectcalico/calico < 3.20.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/projectcalico/calico 3.22.2`\n- `github.com/projectcalico/calico 3.21.5`\n- `github.com/projectcalico/calico 3.20.5`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}