Missing authentication in Telepresence Traffic Manager gRPC API
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Telepresence before 2.31.0 has a Traffic Manager gRPC API on port 8081 that accepts unauthenticated callers from the cluster network (CWE-306). The API stores a caller-supplied namespace and does not check the session's Kubernetes RBAC when creating intercepts. An attacker with any pod that can reach the manager can register in a managed namespace, intercept services and read the victim pod's environment, including secrets, tokens and API keys.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| telepresenceio | telepresence | before 2.31.0 | 2.31.0 | Patch available | CNA |
- telepresence Vendortelepresenceio Affected before 2.31.0 Fixed in 2.31.0 Patch available CNA
Remediation
Upgrade Telepresence to 2.31.0, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA telepresence (telepresenceio) Fixed in 2.31.0
Vendor assessments
Timeline
- 2026-11-04 Threatist record created from CVE-2026-102340
- 2026-11-06 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 6
- https://github.com/telepresenceio/telepresence/security/advisories/GHSA-j8j4-rw65-56r6
- https://github.com/telepresenceio/telepresence/pull/4217
- https://github.com/telepresenceio/telepresence/commit/04ec3464fe8878fdc96420cdc8036edefa0dc9ae
- https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9
- https://github.com/telepresenceio/telepresence/commit/6871235b674a6e843908d09696354c4b0f91578c
- https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0
More telepresenceio vulnerabilities
- TI-2026-85164 Authorization bypass in Telepresence tunnel endpoint enables session hijacking CVSS 3.1HIGH 8.2
Sources
- CVE-2026-102340 · CVE Program
- CVE-2026-102340 · NVD
- FIRST EPSS
- CVE-2026-102340 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences