The vulnerability exists when Calico’s CNI binary alters the incoming configuration before passing it to the Azure IPAM plugin. During this mutation the Azure IPAM helper logs the entire configuration map at INFO level to /var/log/calico/cni/cni.log. When token‑based Kubernetes authentication is used, the logged configuration contains the ServiceAccount token, client key, and certificate authority in plain text, thereby exposing these credentials to anyone who can read the node’s log file. An attacker with read access to this log can extract the credentials and obtain cluster‑wide Calico networking administrator rights, enabling manipulation of networking policy, egress/ingress rules, or denial of traffic.

The flaw impacts Tigera Calico, Calico Cloud, and Calico Enterprise deployments that use the Azure IPAM plugin. Affected versions are not listed, so any installation employing the Azure IPAM helper on these products is potentially vulnerable.

The CVSS score is 6.0, indicating moderate severity; EPSS is not reported, and it is not included in the CISA KEV catalog. Exploitation requires local file read access to /var/log/calico/cni/cni.log, making the attack vector primarily local or authenticated. While the vulnerability has not been widely leveraged, the ability to gain cluster‑wide administrative privileges from the leaked credentials presents a significant risk for compromise if node‑level read permissions can be obtained.