Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/telepresenceio/telepresence

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.5GoAmendedPublished

    Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets

    CVE-2026-102340 · GHSA-j8j4-rw65-56r6

    Affected
    • Go github.com/telepresenceio/telepresence < 2.31.0
    Fixed in
    2.31.0· Vendor fix available
    Issue
    Telepresence's Traffic Manager gRPC API (port 8081) requires no authentication. Any pod with cluster-network access to the Traffic Manager can register as a client in an arbitrary managed namespace and create intercepts against services in that namespace, regardless of Kubernetes RBAC. On interception the victim pod's complete container environment (secrets, tokens, API keys) is delivered to the attacker. Tested on HEAD v2.28.0, commit b2231a4. Details The gRPC server is started with no auth interceptor (pkg/grpc/server/server.go). The connection uses plaintext: `grpc.WithTransportCredentials(insecure.NewCredentials())`. `ArriveAsClient` stores the caller-supplied `Namespace` without verifying the caller is in that namespace. The only gate is whether the namespace is in the Traffic Manager's watchlist (`ManagesNamespace`): ```go // cmd/traffic/cmd/manager/service.go:181-201 func (s *service) ArriveAsClient(..., client *rpc.ClientInfo) (*rpc.SessionInfo, error) { if…

    Recommended action: Upgrade to 2.31.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →