CVE-2026-102339
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
56/100
Published: 2026-11-04
Modified: 2026-11-12
First seen: 2026-11-04
Status: active
Attack Surface
Network
No Interaction
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
Changed
C:
High
I:
High
A:
None
Description
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| telepresenceio | telepresence | < 2.31.0 |
| telepresenceio | telepresence | < 2.31.0 |
References & Advisories (5)
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM