telepresence vulnerabilities
CVEs whose affected-version data names the telepresence package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-102340High· 8.5Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied …
▾ Twilighttelepresenceio · telepresenceEPSS 0.28%via CVEORG
CVE-2026-102339High· 8.2Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/t…
▾ Twilighttelepresenceio · telepresenceEPSS 0.29%via CVEORG