Telepresence: Traffic Manager gRPC authentication bypass (CVE-2026-102340)

The Telepresence Traffic Manager (port 8081) exposes a gRPC API that fails to verify the identity of connecting clients or enforce authorization constraints. Any pod within the cluster network can register as a client and initiate service interceptions against managed namespaces. Because the service performs no Kubernetes Service Account token validation or RBAC checks during registration (ArriveAsClient) or interception (CreateIntercept), an attacker can redirect traffic and capture the full container environment of victim services, including secrets and API keys mounted as environment variables. This vulnerability affects Telepresence versions prior to 2.31.0.

Impact

Successful exploitation allows unauthorized cross-namespace access to service traffic and pod environment secrets. In default cluster-wide deployments where the Traffic Manager manages all namespaces, the entire cluster is exposed to potential credential theft and traffic interception.

Recommendation

• Upgrade Telepresence to version 2.31.0 or later immediately.
• Audit Kubernetes Network Policies to restrict access to the Traffic Manager service (port 8081) to only trusted client namespaces.
• Review Telepresence Traffic Manager logs for suspicious ArriveAsClient or CreateIntercept calls originating from non-authorized pods or unexpected namespaces.