Security readout for executives and security teams
Plain-English summary
This issue can let a compromised, sufficiently privileged pod redirect traffic from a Calico node when IPv6 is enabled but effectively unused. Business impact is potential information disclosure and traffic manipulation inside Kubernetes infrastructure, not a broad unauthenticated internet attack.
Executive priority
Treat as a moderate-priority Kubernetes platform hardening issue. Prioritize clusters that run affected Calico versions, allow privileged pods, or have unused IPv6 enabled. It is not shown as actively exploited in the supplied sources.
Technical view
Calico 3.14.0 and below and Calico Enterprise 2.8.2 and below may accept IPv6 route advertisements by default. A compromised privileged pod can reconfigure node IPv6 routing and redirect full or partial node traffic. CVSS 3.1 score is 6.0 with high attack complexity.
Likely exposure
Likely exposure is Kubernetes clusters using affected Calico or Calico Enterprise versions where IPv6 is enabled but unused. Clusters without IPv6 or without the vulnerable routing behavior are less likely exposed. The bundle does not provide prevalence data.
Exploitation context
The bundle does not indicate KEV listing or confirmed active exploitation. Exploitation requires an already compromised pod with sufficient privilege and a vulnerable IPv6 route advertisement configuration, which narrows practical risk but remains serious in shared clusters.
Researcher notes
Key uncertainty is the exact fixed version or vendor-approved mitigation, because the bundle lists affected versions and references but does not name a patch. Avoid assuming exploitability without confirming IPv6 state, route advertisement behavior, and pod privilege exposure.
Mitigation direction
- Check Tigera Calico security guidance for the supported fixed version or configuration mitigation.
- Inventory Calico and Calico Enterprise versions across all Kubernetes clusters.
- Identify clusters where IPv6 is enabled but not intentionally used.
- Reduce privileged pod usage and review workloads with elevated networking capability.
- Review node IPv6 route advertisement handling against vendor and platform guidance.
Validation and detection
- Confirm Calico or Calico Enterprise version on each cluster.
- Verify whether IPv6 is enabled on worker and control-plane nodes.
- Check whether nodes accept IPv6 route advertisements by default.
- Review privileged pods and workloads with network configuration permissions.
- Document whether vendor guidance has been applied per cluster.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-201: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-13597 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L1.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.projectcalico.org/security-bulletins/CVE reference · x_refsource_CONFIRM
- https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8CVE reference · x_refsource_CONFIRM
- https://github.com/kubernetes/kubernetes/issues/91507CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.