CVE-2026-102339

Full vulnerability record from the local CVENow database.

Description

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.

Severity

HIGH

CVSS score

8.2 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-04 21:17:40.500000

Last modified

2026-11-04 21:17:40.500000

View original CVE JSON

{
  "id": "CVE-2026-102339",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T21:17:40.500",
  "lastModified": "2026-11-04T21:17:40.500",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "telepresenceio",
          "product": "telepresence",
          "versions": [
            {
              "version": "< 2.31.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.8
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/telepresenceio/telepresence/pull/4217",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf",
      "source": "[email protected]"
    }
  ]
}