A path traversal vulnerability in Tigera Calico's Application Layer Policy may allow unauthenticated attackers to bypass intended network security restrictions.

This is a path traversal vulnerability (CWE-22, CWE-23) occurring within the Dikastes component. The lack of URL path normalization allows an unauthenticated attacker to craft malicious requests that may circumvent HTTP-based security policies.

Successful exploitation allows an attacker to bypass granular access controls defined in Application Layer Policies. This could lead to unauthorized access to restricted internal resources, potentially resulting in data exposure or the compromise of sensitive backend services. Given the CVSS score of 7.9, this vulnerability presents a high risk to the confidentiality and integrity of containerized environments.

Immediate Action: Upgrade to the patched versions specified in the vendor advisory (Calico 3.31.6, Calico Enterprise 3.21.7 or 3.22.4, or Calico Cloud 22.4.0).

Proactive Monitoring: Monitor network and application logs for unusual request patterns, particularly those containing encoded characters or directory traversal sequences aimed at sensitive endpoints.

Compensating Controls: Ensure that strict input validation and path normalization are implemented at the ingress controller level to provide defense-in-depth while patches are applied.

Public Exploit Available: No

Organizations utilizing Tigera Calico should prioritize patching immediately to prevent potential security policy bypasses. Failure to address this flaw could allow attackers to traverse network boundaries, necessitating an urgent update cycle for all affected deployments.