Calico’s shared debug server exposes its Go pprof listener on an unrestricted 0.0.0.0 interface without authentication. An attacker who can reach the listener may retrieve the process heap, goroutine stacks (including function arguments), and command‑line arguments. These artifacts can leak confidential data such as secrets or sensitive configuration, compromising the confidentiality of the cluster. The vulnerability does not directly cause denial of service or modify system state, but the information disclosure can be leveraged for further attacks.

This issue affects Tigera Calico, Calico Cloud, and Calico Enterprise deployments, specifically the kube‑controllers and Goldmane components that enable the shared debug server. The debug functionality is opt‑in and disabled by default, so only systems with the debug server enabled are vulnerable; no specific version range is listed in the advisory.

The CVSS score of 6 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be network‑based: any pod or host with network reachability to the debug listener can exploit it. While the default binding to 0.0.0.0 increases exposure, adequate network segmentation or firewall rules can reduce the likelihood of exploitation. The risk is higher in exposed or poorly segmented environments.