CVE-2022-28224

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

5.5

EPSS

0.57%

Published

Jun 6, 2022

Modified

Sep 30, 2025

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

Weaknesses (CWE)

CWE-200CWE-201CWE-20

Affected Products (5)

tigera · calico (up to 3.20.5)vulnerable

tigera · calico (up to 3.21.5)vulnerable

tigera · calico (up to 3.22.2)vulnerable

tigera · calico_enterprise (up to 3.11.4)vulnerable

tigera · calico_enterprisevulnerable

References (2)

https://www.tigera.io/security-bulletins-tta-2022-001/

Vendor Advisory

https://www.tigera.io/security-bulletins-tta-2022-001/

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs