---
id: CVE-2022-28224
aliases:
  - GHSA-9394-xfq9-6qrp
title: Calico vulnerable to pod route hijacking
summary: Calico vulnerable to pod route hijacking
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H'
vendor: projectcalico
product: github.com/projectcalico/calico
ecosystem: go
affected:
  - 'github.com/projectcalico/calico >= 3.22.0, < 3.22.2'
  - 'github.com/projectcalico/calico >= 3.21.0, < 3.21.5'
  - github.com/projectcalico/calico < 3.20.5
patched:
  - github.com/projectcalico/calico 3.22.2
  - github.com/projectcalico/calico 3.21.5
  - github.com/projectcalico/calico 3.20.5
published: '2022-06-07'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9394-xfq9-6qrp'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-28224'
  - url: 'https://github.com/projectcalico/calico'
  - url: 'https://www.tigera.io/security-bulletins-tta-2022-001'
tags:
  - osv
  - go
epss: 0.00591
epssPercentile: 0.45921
ingestedAt: '2026-08-07T19:14:16.480Z'
---

## Overview

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

## Affected packages

- `github.com/projectcalico/calico >= 3.22.0, < 3.22.2`
- `github.com/projectcalico/calico >= 3.21.0, < 3.21.5`
- `github.com/projectcalico/calico < 3.20.5`

## Remediation

Upgrade to a patched release:

- `github.com/projectcalico/calico 3.22.2`
- `github.com/projectcalico/calico 3.21.5`
- `github.com/projectcalico/calico 3.20.5`