CVE-2026-81664

Received Received - Intake

OpenFaaS Gateway Unauthenticated Access to Telemetry Endpoint

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81664

EUVD

EUVD-2026-67033

Affected Vendors & Products

Vendor	Product	Version / Range
openfaas	gateway	to 0.27.14 (exc)
openfaas	gateway	From 0.27.14 (inc)
openfaas	gateway	From 0.27.11 (inc) to 0.27.13 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-81664 is a vulnerability in OpenFaaS Gateway versions 0.27.11 through 0.27.13 where the /system/telemetry route lacks authentication. The telemetry handler was not included in the BasicAuth protection applied to other administrative /system/* routes, allowing unauthenticated users to access telemetry data such as resource metrics or pod/cluster state by querying the exposed route.

Detection Guidance

To detect this vulnerability, check if your OpenFaaS gateway version is between 0.27.11 and 0.27.13. Use the command: curl -k http://<gateway-ip>:8080/system/telemetry. If the response returns telemetry data without requiring authentication, the system is vulnerable.

Impact Analysis

This vulnerability allows any client with network access to the OpenFaaS gateway to read sensitive telemetry data without authentication. The exposed data may include resource usage, function invocations, or pod/cluster state, depending on the provider. This could lead to information disclosure, potential reconnaissance for further attacks, or compliance violations due to unauthorized data exposure.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing sensitive telemetry data without proper authentication. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. Unauthorized access to such data may result in violations, fines, or legal consequences depending on the exposed content and applicable regulations.

Mitigation Strategies

Upgrade OpenFaaS gateway to version 0.27.14 or later. If upgrading is not immediately possible, restrict network access to the gateway port 8080 using firewalls or network policies to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-81664. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70