CVE-2026-102339
Received Received - Intake

Telepresence Tunnel Session Hijacking via Unverified Session ID

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-102339
EUVD
EUVD-2026-117078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
telepresenceio telepresence < 2.31.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Telepresence's Traffic Manager Tunnel gRPC streaming endpoint. It allows an attacker to hijack active client sessions by supplying a valid session ID without verifying ownership. The session ID is parsed from client-controlled messages, enabling unauthorized access to network routing capabilities if session IDs are exposed through logs or internal channels.

Detection Guidance

Detecting this vulnerability requires checking Telepresence versions and monitoring for unauthorized session attachments. Verify installed versions with 'telepresence version' and inspect logs for session ID leaks. Monitor network traffic for unexpected gRPC Tunnel connections to the Traffic Manager endpoint. Check for unauthorized session attachments by reviewing Kubernetes API audit logs for suspicious SubjectAccessReview or TokenReview requests.

Impact Analysis

An attacker could gain full network routing capabilities of a legitimate Telepresence client, potentially intercepting or redirecting traffic. This could lead to unauthorized access to sensitive data or systems if session IDs are exposed via logs or internal channels.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal consequences due to compromised network routing capabilities.

Mitigation Strategies

Upgrade Telepresence to version 2.31.0 or later immediately. Enable enforcing authentication mode in the traffic-manager configuration to require valid tokens for all operations. Rotate all exposed session IDs and credentials. Review and restrict access to internal cluster channels where session IDs might leak. Monitor for unauthorized session attachments post-upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102339. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...