---
id: CVE-2026-6540
title: >-
  Calico's Application Layer Policy (disabled by default), which enforces HTTP
  rules through Dikastes, fails to perform URL path normalization
summary: >-
  Calico's Application Layer Policy (disabled by default), which enforces HTTP
  rules through Dikastes, fails to perform URL path normalization. As a result,
  HTTP requests using path-traversal segments, encoded slashes, or repeated
  slashes …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
  - CWE-23
vendor: tigera
product: calico
affected:
  - calico < 3.21.7
  - calico < 3.31.6
  - calico <= 22.4.0
  - 'calico >= 3.22.0, < 3.22.4'
  - 'calico >= 3.32.0, < 3.32.1'
patched:
  - calico 3.32.1
published: '2026-07-30'
updated: '2026-08-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6540'
references:
  - url: 'https://github.com/projectcalico/calico/pull/12531'
    label: psirt@tigera.io
  - url: 'https://github.com/projectcalico/calico/pull/12532'
    label: psirt@tigera.io
  - url: 'https://github.com/projectcalico/calico/pull/12533'
    label: psirt@tigera.io
  - url: 'https://www.tigera.io/security-bulletins/tta-2026-005/'
    label: psirt@tigera.io
tags:
  - nvd
epss: 0.00367
epssPercentile: 0.30547
ingestedAt: '2026-08-08T13:22:52.581Z'
---

## Overview

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

## Affected

- `calico < 3.21.7`
- `calico < 3.31.6`
- `calico <= 22.4.0`
- `calico >= 3.22.0, < 3.22.4`
- `calico >= 3.32.0, < 3.32.1`

## Remediation

Upgrade past the affected range:

- `calico 3.32.1`