CVE-2026-102340 — Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets

Exploitation evidence

Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.

KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗

Reported products and versions

telepresenceio / telepresence

Default status: Not specified

affected: < 2.31.0

Fixes and workarounds

No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.

Sources and related reporting

CVE Program record ↗ · Download tracked evidence as JSON

Monitored source mentions

GitHub Advisory Database — Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets ↗

Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.

Reviewed Egret reports

Telepresence traffic manager lets any cluster pod steal intercepted services' environment secrets

Observed change timeline

History begins when Egret first downloads each source. It is not the complete upstream CVE history.

12 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-12",
  "epss": 0.00281,
  "percentile": 0.20902
}

10 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-10",
  "epss": 0.00281,
  "percentile": 0.20821
}

10 Nov 2026, 12:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-09",
  "epss": 0.00281,
  "percentile": 0.20781
}

10 Nov 2026, 12:20 Jerusalem · CVE Program record changed

Stored CNA snapshot at this observation.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102340",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T16:09:24.840793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T16:58:40.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "telepresence",
          "vendor": "telepresenceio",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:39:55.525Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-j8j4-rw65-56r6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-j8j4-rw65-56r6"
        },
        {
          "name": "https://github.com/telepresenceio/telepresence/pull/4217",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/telepresenceio/telepresence/pull/4217"
        },
        {
          "name": "https://github.com/telepresenceio/telepresence/commit/04ec3464fe8878fdc96420cdc8036edefa0dc9ae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/telepresenceio/telepresence/commit/04ec3464fe8878fdc96420cdc8036edefa0dc9ae"
        },
        {
          "name": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"
        },
        {
          "name": "https://github.com/telepresenceio/telepresence/commit/6871235b674a6e843908d09696354c4b0f91578c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/telepresenceio/telepresence/commit/6871235b674a6e843908d09696354c4b0f91578c"
        },
        {
          "name": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j8j4-rw65-56r6",
        "discovery": "UNKNOWN"
      },
      "title": "Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102340",
    "datePublished": "2026-11-04T20:39:55.525Z",
    "dateReserved": "2026-09-28T22:38:42.254Z",
    "dateUpdated": "2026-11-09T16:58:40.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}