CVE-2026-102340

Received Received - Intake

Unauthenticated Traffic Manager API Access in Telepresence

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-102340

EUVD

EUVD-2026-117096

Affected Vendors & Products

Vendor	Product	Version / Range
telepresenceio	telepresence	< 2.31.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in Telepresence versions before 2.31.0 allows an attacker with network access to the cluster to exploit unauthenticated gRPC API calls on port 8081. The attacker can register in any managed namespace, create service intercepts, and receive intercepted traffic from victim pods. This exposes the victim's complete container environment, including secrets, tokens, and API keys.

Detection Guidance

Check if Telepresence Traffic Manager is running on port 8081 without authentication. Inspect gRPC API calls to the manager for unauthenticated requests. Verify if any pods can register in arbitrary namespaces or create intercepts without proper RBAC checks.

Impact Analysis

An attacker could intercept sensitive data like API keys, tokens, or secrets from your applications running in Kubernetes. This could lead to unauthorized access to systems, data breaches, or lateral movement within the cluster. The default cluster-wide deployment manages all namespaces, increasing the attack surface.

Mitigation Strategies

Upgrade Telepresence to version 2.31.0 or later to enable authentication and RBAC checks. Configure the Traffic Manager to enforcing mode for strict token validation. Review and restrict network access to the Traffic Manager's gRPC API on port 8081.

Hi! I’m here to help you understand CVE-2026-102340. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...