CVE-2026-102340
Description
A flaw was found in Telepresence. The Traffic Manager fails to authenticate internal cluster requests or verify Role-Based Access Control (RBAC) permissions when registering clients and creating service intercepts. An attacker with access to any pod on the cluster network can exploit this flaw to register within arbitrary namespaces, intercept service traffic, and access sensitive information including application secrets, tokens, and environment variables.
Statement
This vulnerability is rated as Important because an attacker with access to any pod within a cluster can bypass authorization controls and pivot across namespace boundaries. In standard cluster deployments where the management service oversees all namespaces, unauthenticated internal requests allow unauthorized callers to intercept application traffic. This enables the exfiltration of sensitive pod configurations, environment variables, and authentication tokens from other tenant workloads without requiring administrative privileges.
Mitigation
Restrict network access to the Traffic Manager service and limit its operational scope:
1. Apply an OpenShift or Kubernetes NetworkPolicy targeting the Traffic Manager deployment to block ingress traffic to TCP port 8081, permitting connections only from authorized pods or trusted management CIDRs.
2. Reconfigure Traffic Manager to manage only designated development namespaces rather than running in cluster-wide mode.
Caveat: Applying ingress restrictions may terminate active intercepts and prevent clients in unauthorized namespaces from establishing connection sessions.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce ServiceAccount bearer token authentication and RBAC authorization on Traffic Manager gRPC port 8081 before processing client registrations or service intercepts: upgrade to Telepresence 2.31.0, which authenticate callers using bearer ServiceAccount tokens validated with TokenReviews and enforce Kubernetes RBAC permissions using SubjectAccessReviews before creating intercepts, closing all 2 injection vectors (unauthenticated ArriveAsClient gRPC requests, unauthorized CreateIntercept gRPC calls). Until patched, this is a concern on Kubernetes and OpenShift clusters running Telepresence Traffic Manager with cluster-network pod access, so Apply Kubernetes or OpenShift NetworkPolicies blocking ingress to TCP port 8081 from unauthorized pods and restrict Traffic Manager to manage only designated development namespaces instead of running cluster-wide. As a compensating measure, Interpose an identity-aware reverse proxy in front of the Traffic Manager gRPC port to require mutual authentication and identity verification, Restrict egress traffic from non-development workloads to prevent pods from initiating outbound connections to the Traffic Manager service, and Block unauthenticated and unauthorized requests at the API layer by denying access to endpoints unless explicitly authorized. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authentication and authorization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-206 Network Policy (Kubernetes) (high)
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
