CVE-2026-102339

github.com/telepresenceio/telepresence: Telepresence: Unauthorized network routing access via missing session ownership verification

github.com/telepresenceio/telepresence

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient…

4. Nov 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• NVD
  CVE-2026-102339