Cve-2026-102340 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-102340/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 02:06:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTelepresence: Traffic Manager gRPC authentication bypass (CVE-2026-102340)https://feed.craftedsignal.io/briefs/2026-11-telepresence-grpc-auth/Wed, 11 Nov 2026 02:06:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-telepresence-grpc-auth/The Telepresence Traffic Manager gRPC API lacks authentication, allowing any pod with network access to intercept services and exfiltrate secrets from unauthorized Kubernetes namespaces.The Telepresence Traffic Manager (port 8081) exposes a gRPC API that fails to verify the identity of connecting clients or enforce authorization constraints. Any pod within the cluster network can register as a client and initiate service interceptions against managed namespaces. Because the service performs no Kubernetes Service Account token validation or RBAC checks during registration (ArriveAsClient) or interception (CreateIntercept), an attacker can redirect traffic and capture the full container environment of victim services, including secrets and API keys mounted as environment variables. This vulnerability affects Telepresence versions prior to 2.31.0.

Impact

Successful exploitation allows unauthorized cross-namespace access to service traffic and pod environment secrets. In default cluster-wide deployments where the Traffic Manager manages all namespaces, the entire cluster is exposed to potential credential theft and traffic interception.

Recommendation

  • Upgrade Telepresence to version 2.31.0 or later immediately.
  • Audit Kubernetes Network Policies to restrict access to the Traffic Manager service (port 8081) to only trusted client namespaces.
  • Review Telepresence Traffic Manager logs for suspicious ArriveAsClient or CreateIntercept calls originating from non-authorized pods or unexpected namespaces.
]]>highadvisoryvulnerabilitykubernetestelepresencecve-2026-102340