Telepresence Traffic Manager: unverified session ID on the Tunnel stream lets a caller hijack another session's routing

Impact

The Traffic Manager's Tunnel streaming endpoint reads a session ID out of the first bytes of a caller-controlled message and hands it to state.Tunnel without checking that the caller owns that session. Anyone who learns an active session ID - from logs, from cluster-internal traffic, or by using the unauthenticated ArriveAsClient endpoint - can attach a routed tunnel to it and inherit its network routing into the cluster. On a GPU cluster where Telepresence is installed for development, that means reaching in-cluster services that are otherwise unreachable: model-serving endpoints, internal registries, schedulers and storage control planes. The record notes UUID4 session IDs make cold brute force impractical, so this depends on obtaining an ID, and the practical fix is to not run an unpatched Traffic Manager on a production fleet at all.

Who can reach it

A caller who can reach the Traffic Manager's gRPC endpoint and has obtained a valid active session ID. Low privilege per the vector; no session ownership proof required.

What to do

Upgrade Telepresence to 2.31.0 or later and restart the Traffic Manager deployment; clients should be upgraded to match. If Telepresence is not actually in use, uninstall the Traffic Manager rather than leaving it reachable. Control-plane component - no GPU node drain.

References

Related entries

• Kyverno: CEL expressions evaluated without runtime cost limits OOM-kill the admission podsCVE-2026-122309 · Kyverno CEL policy evaluation (NamespacedValidatingPolicy / NamespacedDeletingPolicy)High
• Nexus Repository 3: read-only users can upload artifacts to Swift, Terraform and Conda reposCVE-2026-14504 · Sonatype Nexus Repository 3 (component upload API, Swift/Terraform/Conda hosted repos)High
• BuildKit: Insufficient validation of git URL fragment subdir allows access to files outside the intended checkoutCVE-2026-33748 · BuildKitHigh
• Kata Containers: Oversight in the CopyFile policy from v3.4.0 to v3.28.0CVE-2026-41326 · Kata ContainersHigh
• Open Cluster Management: forged client certificate lets a managed-cluster admin pivot to the hubCVE-2026-4740 · Open Cluster Management / Red Hat ACM multicluster engine (client certificate renewal)High
• containerd: CRI restores container.log from a checkpoint image without validating symlinksCVE-2026-53489 · containerdHigh