CVE-2026-102340 is a high-severity (CVSS 8.5) Missing Authentication vulnerability. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network…
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Description
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
The records we use list no fixed release for CVE-2026-102340. Check the upstream advisory for a patched version, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability is rated as Important because an attacker with access to any pod within a cluster can bypass authorization controls and pivot across namespace boundaries. In standard cluster deployments where the management service oversees all namespaces, unauthenticated internal requests allow unauthorized…
Restrict network access to the Traffic Manager service and limit its operational scope: 1. Apply an OpenShift or Kubernetes NetworkPolicy targeting the Traffic Manager deployment to block ingress traffic to TCP port 8081, permitting connections only from authorized pods or trusted management CIDRs. 2. Reconfigure Traffic Manager to manage only designated development namespaces rather than running in cluster-wide mode. Caveat: Applying ingress restrictions may terminate active intercepts and prevent clients in unauthorized namespaces from establishing connection sessions. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy,…Source: Red Hat security advisory for CVE-2026-102340 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-102340 in your dependencies?
Find it across your dependency tree, including transitive dependencies.