Skip to content
OpenAdvisories

Vendor

telepresenceio

2 known vulnerabilities.

Products

telepresence 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.5
    CVE-2026-102340

    Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets

    Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only t…

    telepresenceio telepresence github.com/telepresenceio/telepresence Go
  • High 8.2
    CVE-2026-102339

    Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

    Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and p…

    telepresenceio telepresence github.com/telepresenceio/telepresence/v2 Go