When the calicoctl command is run with a log level of info or debug, the tool writes its entire connection configuration structure to standard error. This structure contains all credentials the client uses to communicate with the Kubernetes API, etcd, and other cluster components, including bearer tokens and PEM‑encoded certificates. As a result, any process or user that can read the standard error stream—such as CI job logs, session recordings, or local log files—can extract these credentials without needing any Kubernetes privileges.

The flaw affects Tigera Calico, Calico Cloud, and Calico Enterprise deployments. The issue is present in all exposed versions, including the explicitly cited Calico Enterprise 3.22.3. Clients that run calicoctl under these products and enable verbose logging are impacted.

The vulnerability scores a CVSS of 7.2, indicating moderate to high severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. Attacks are local in nature; any entity that can invoke calicoctl with an elevated log level or can access the resulting log output has the ability to obtain cluster credentials. Therefore the risk is significant for environments where standard error output is logged or otherwise exposed.