{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-102340/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:telepresence:telepresence:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-102340"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Telepresence (\u003c 2.31.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","kubernetes","telepresence","cve-2026-102340"],"_cs_type":"advisory","_cs_vendors":["Telepresence"],"content_html":"\u003cp\u003eThe Telepresence Traffic Manager (port 8081) exposes a gRPC API that fails to verify the identity of connecting clients or enforce authorization constraints. Any pod within the cluster network can register as a client and initiate service interceptions against managed namespaces. Because the service performs no Kubernetes Service Account token validation or RBAC checks during registration (ArriveAsClient) or interception (CreateIntercept), an attacker can redirect traffic and capture the full container environment of victim services, including secrets and API keys mounted as environment variables. This vulnerability affects Telepresence versions prior to 2.31.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized cross-namespace access to service traffic and pod environment secrets. In default cluster-wide deployments where the Traffic Manager manages all namespaces, the entire cluster is exposed to potential credential theft and traffic interception.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Telepresence to version 2.31.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit Kubernetes Network Policies to restrict access to the Traffic Manager service (port 8081) to only trusted client namespaces.\u003c/li\u003e\n\u003cli\u003eReview Telepresence Traffic Manager logs for suspicious \u003ccode\u003eArriveAsClient\u003c/code\u003e or \u003ccode\u003eCreateIntercept\u003c/code\u003e calls originating from non-authorized pods or unexpected namespaces.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T02:06:12Z","date_published":"2026-11-11T02:06:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-telepresence-grpc-auth/","summary":"The Telepresence Traffic Manager gRPC API lacks authentication, allowing any pod with network access to intercept services and exfiltrate secrets from unauthorized Kubernetes namespaces.","title":"Telepresence: Traffic Manager gRPC authentication bypass (CVE-2026-102340)","url":"https://feed.craftedsignal.io/briefs/2026-11-telepresence-grpc-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-102340","version":"https://jsonfeed.org/version/1.1"}