{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/telepresence-v2--2.31.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:telepresence:telepresence:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-102339"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Telepresence (v2 \u003c 2.31.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Telepresence"],"content_html":"\u003cp\u003eThe Traffic Manager \u003ccode\u003eTunnel\u003c/code\u003e gRPC streaming endpoint in Telepresence accepts a session ID from the initial client-controlled message payload without verifying the caller's identity. This allows an attacker to supply an active session ID and receive a fully functional tunnel, gaining the network routing capabilities of the associated legitimate client. The issue is exacerbated by the lack of authentication on the \u003ccode\u003eArriveAsClient\u003c/code\u003e endpoint, which allows attackers to generate their own valid session IDs. The vulnerability affects Telepresence versions prior to 2.31.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a connection to the Traffic Manager gRPC service (often exposed on port 8081).\u003c/li\u003e\n\u003cli\u003eAttacker invokes the \u003ccode\u003eArriveAsClient\u003c/code\u003e endpoint to generate a session or harvests an existing session ID via log leakage.\u003c/li\u003e\n\u003cli\u003eAttacker initializes a \u003ccode\u003eTunnel\u003c/code\u003e bidirectional gRPC stream.\u003c/li\u003e\n\u003cli\u003eAttacker sends a \u003ccode\u003eTunnelMessage\u003c/code\u003e payload containing the target victim session ID.\u003c/li\u003e\n\u003cli\u003eTraffic Manager processes the message in \u003ccode\u003estate.Tunnel\u003c/code\u003e and associates the attacker's stream with the victim's session in the internal map.\u003c/li\u003e\n\u003cli\u003eAttacker gains the ability to intercept or inject traffic into the victim's network routing context.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to impersonate a legitimate developer session within a cluster. This grants the attacker the same network routing capabilities as the victim, enabling unauthorized access to cluster-internal resources or network paths reachable by the Telepresence client.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Telepresence Traffic Manager to version 2.31.0 or later immediately to incorporate session ownership verification.\u003c/li\u003e\n\u003cli\u003eAudit cluster-internal network access to the Traffic Manager gRPC service to ensure only authorized clients can reach the endpoint.\u003c/li\u003e\n\u003cli\u003eReview centralized logging for any instances where \u003ccode\u003eArriveAsClient\u003c/code\u003e or \u003ccode\u003eTunnel\u003c/code\u003e endpoints are being accessed by unexpected or non-standard client service accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T10:17:33Z","date_published":"2026-11-10T10:17:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-telepresence-tunnel-hijack/","summary":"The Telepresence Traffic Manager fails to verify ownership of session IDs in the Tunnel gRPC endpoint, allowing attackers to hijack active client sessions and gain unauthorized access to network routing contexts.","title":"Telepresence: Traffic Manager session hijacking via unauthenticated Tunnel endpoint (CVE-2026-102339)","url":"https://feed.craftedsignal.io/briefs/2026-11-telepresence-tunnel-hijack/"}],"language":"en","title":"CraftedSignal Threat Feed - Telepresence (V2 \u003c 2.31.0)","version":"https://jsonfeed.org/version/1.1"}