Calico Vulnerability Disclosure

generated: '2026-09-05'
method: searched
probe: true
source: >-
  https://www.tigera.io/vulnerability-disclosure/ ,
  https://github.com/projectcalico/calico/blob/master/SECURITY.md ,
  https://www.tigera.io/security-bulletins/
description: >-
  Calico runs a real, documented disclosure programme across two surfaces — Tigera's corporate
  Vulnerability Disclosure Policy for the commercial editions, and Project Calico's own SECURITY.md
  for the open source project. Neither is machine-discoverable: there is no /.well-known/security.txt
  on any host (see well-known/calico-well-known.yml).
policy_url: https://www.tigera.io/vulnerability-disclosure/
policy_http_status: 200
project_policy_url: https://github.com/projectcalico/calico/blob/master/SECURITY.md
security_bulletins: https://www.tigera.io/security-bulletins/
security_bulletins_http_status: 200
contacts:
- kind: email
  value: psirt@projectcalico.org
  scope: Project Calico open source
  source: SECURITY.md
- kind: github-security-advisory
  value: https://github.com/projectcalico/calico/security/advisories
  scope: Project Calico open source — private advisory through the GitHub interface
  source: SECURITY.md
supported_versions:
  quote: >-
    "The Tigera team generally support the most recent two minor versions of Project Calico on a
    rolling basis. Support for older versions is on a case-by-case basis."
  source: SECURITY.md
  current: [v3.32.x, v3.31.x]
reporting_rules:
  quote: >-
    "Do not create a GitHub issue or pull request because those are immediately public."
  source: SECURITY.md
  requested_detail: affected version(s) and steps to reproduce
third_party_cves:
  policy: >-
    Calico publishes a VEX repository (https://github.com/tigera/vex) analysing third-party CVEs
    that scanners such as Trivy, Grype and Docker Scout flag in Calico container images — whether
    each is exploitable or applicable to supported versions. Reporters are asked to check it before
    filing.
  vex_repository: https://github.com/tigera/vex
  note: >-
    A published VEX feed is a stronger-than-average disclosure posture; most providers in this
    catalog publish nothing equivalent.
bug_bounty:
  program: none found
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  result: no public programme found on any of the three
security_txt:
  present: false
  probed:
  - url: https://www.tigera.io/.well-known/security.txt
    status: 404
  - url: https://docs.tigera.io/.well-known/security.txt
    status: 404
  - url: https://projectcalico.org/.well-known/security.txt
    status: 301
  recommendation: >-
    Publishing an RFC 9116 security.txt with Contact psirt@projectcalico.org and Policy
    https://www.tigera.io/vulnerability-disclosure/ would make an existing, well-run programme
    machine-discoverable. The content already exists; only the file is missing.
evidence:
- source: https://www.tigera.io/vulnerability-disclosure/
  kind: disclosure page
  http_status: 200
  keywords: [vulnerability, security research, security issue]
- source: https://github.com/projectcalico/calico/blob/master/SECURITY.md
  kind: project security policy
  http_status: 200
  keywords: [Reporting a Vulnerability, psirt@projectcalico.org, security advisory, Supported Versions]
- source: https://www.tigera.io/security-bulletins/
  kind: security bulletins index
  http_status: 200