Authorization bypass in Telepresence tunnel endpoint enables session hijacking
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Telepresence before 2.31.0 lets a caller bypass ownership checks on the Traffic Manager Tunnel gRPC streaming endpoint. The endpoint takes a session ID from the caller's message and attaches a routed tunnel to that session without verifying that the caller owns it (CWE-639). A remote attacker who obtains a valid active session ID, for example through log leakage or the unauthenticated ArriveAsClient endpoint, can gain the session's network routing capabilities. The CVSS 3.1 base score is 8.2 (HIGH) and the attacker needs low privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| telepresenceio | telepresence | before 2.31.0 | 2.31.0 | Patch available | CNA |
- telepresence Vendortelepresenceio Affected before 2.31.0 Fixed in 2.31.0 Patch available CNA
Remediation
Upgrade Telepresence to version 2.31.0, which fixes the flaw. Red Hat lists one product as not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA telepresence (telepresenceio) Fixed in 2.31.0
Vendor assessments
Timeline
- 2026-11-04 Threatist record created from CVE-2026-102339
- 2026-11-06 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf
- https://github.com/telepresenceio/telepresence/pull/4217
- https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6
- https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9
- https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0
More telepresenceio vulnerabilities
- TI-2026-85184 Missing authentication in Telepresence Traffic Manager gRPC API CVSS 3.1HIGH 8.5
Sources
- CVE-2026-102339 · CVE Program
- CVE-2026-102339 · NVD
- FIRST EPSS
- CVE-2026-102339 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences