In Tigera Calico, the init container that installs the CNI writes the rendered configuration to standard output. When the configuration template contains the token placeholder, the live Kubernetes ServiceAccount bearer token is substituted into that output and logged. This exposes a privileged token to any authenticated user who can read pod logs in the namespace where calico-node runs. The token grants patch permissions on pod status, allowing attackers to modify annotations and potentially disrupt or compromise cluster workloads.

All released versions of Tigera Calico up to at least version 3.32.0 are affected. The product description does not explicitly state if later releases have addressed the issue, so a patch or upgrade should be verified for each environment.

The CVSS score of 6 indicates moderate severity. No EPSS score is available, therefore the exact likelihood of exploitation is uncertain. The weakness is classified as CWE‑532: Information Exposure through Log File. The vulnerability is not listed in the CISA KEV catalog and relies on users already having pod log access, which could be a common privilege in many clusters.