{"cve":"CVE-2020-13597","nvd":{"published":"2020-06-03T17:15:24.887","modified":"2026-06-17T02:53:25.920","status":"Modified","description":"Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":3.5},"cwes":["CWE-200","CWE-201"],"references":["https://github.com/kubernetes/kubernetes/issues/91507","https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8","https://www.projectcalico.org/security-bulletins/","https://github.com/kubernetes/kubernetes/issues/91507","https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8"],"products":["projectcalico:calico"],"source":"nvd","synced_at":"2026-10-19T21:05:42.039641217+00:00"},"epss":{"cve":"CVE-2020-13597","score":0.00902,"percentile":0.59743,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-pf59-j7c2-rh6x","url":"https://osv.dev/vulnerability/GHSA-pf59-j7c2-rh6x","summary":"Exposure of Sensitive Information to an Unauthorized Actor and Insertion of Sensitive Information Into Sent Data in Calico","modified":"2026-08-07T08:12:23.591761807Z","packages":[{"ecosystem":"Go","name":"github.com/projectcalico/calico","purl":"pkg:golang/github.com/projectcalico/calico","ranges":[">=3.14.0 <3.14.1"],"fixed":["3.14.1"]},{"ecosystem":"Go","name":"github.com/projectcalico/calico","purl":"pkg:golang/github.com/projectcalico/calico","ranges":[">=3.13.0 <3.13.4"],"fixed":["3.13.4"]},{"ecosystem":"Go","name":"github.com/projectcalico/calico","purl":"pkg:golang/github.com/projectcalico/calico","ranges":[">=3.12.0 <3.12.2"],"fixed":["3.12.2"]},{"ecosystem":"Go","name":"github.com/projectcalico/calico","purl":"pkg:golang/github.com/projectcalico/calico","ranges":[">=3.11.0 <3.11.3"],"fixed":["3.11.3"]},{"ecosystem":"Go","name":"github.com/projectcalico/calico","purl":"pkg:golang/github.com/projectcalico/calico","ranges":[">=3.10.0 <3.10.4"],"fixed":["3.10.4"]},{"ecosystem":"Go","name":"github.com/projectcalico/calico","purl":"pkg:golang/github.com/projectcalico/calico","ranges":[">=3.9.0 <3.9.6"],"fixed":["3.9.6"]},{"ecosystem":"Go","name":"github.com/projectcalico/calico","purl":"pkg:golang/github.com/projectcalico/calico","ranges":["<3.8.9"],"fixed":["3.8.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}