Telepresence Traffic Manager: any in-cluster pod can intercept traffic and read pod environments

Impact

The Traffic Manager's gRPC API accepts unauthenticated callers from anywhere on the cluster network, and neither ArriveAsClient nor CreateIntercept checks the caller's Kubernetes RBAC against the namespace it claims. Any pod that can reach the manager can register itself in an arbitrary managed namespace, create an intercept on a running service, and receive that service's live traffic plus the victim pod's full container environment - service account tokens, registry and model-API keys, database credentials. On a shared GPU cluster this is a tenant-to-tenant break: the default install manages every namespace, so one tenant's training or inference pod can harvest another tenant's secrets and hijack requests to their inference endpoints. If Telepresence was installed for developer convenience and left running, the exposure is cluster-wide and silent.

Who can reach it

Any workload with network access to the Traffic Manager service on port 8081 - that is, any pod in the cluster unless NetworkPolicy blocks it. No authentication and no Kubernetes credentials are needed.

What to do

Upgrade the Traffic Manager to 2.31.0 or later (Helm/kubectl rollout of the manager Deployment; no node disruption, in-flight intercepts drop). If the upgrade cannot happen immediately, scale the Traffic Manager to zero or restrict it with a NetworkPolicy that allows only developer-egress sources, and narrow the managed-namespace list away from cluster-wide. Treat any secret present in an interceptable pod's environment as potentially exposed and rotate it.

References

Related entries

• Contrast: node installer writes containerd config world-writable, giving local users node takeoverCVE-2026-109358 · Edgeless Systems Contrast (node installer, containerd config file permissions)High
• Kyverno verifyImages: cache keyed by tag, not digest, lets a moved tag admit an unverified imageCVE-2026-122321 · Kyverno verifyImages (signature verification cache keyed by image reference)High
• LXD: crafted image templates escape the instance template directory and read or create host filesCVE-2026-16033 · LXD (image metadata template handling, QEMU/VM driver paths)High
• RHACM cluster-proxy: caller-supplied impersonation headers grant cluster-admin on managed clustersCVE-2026-17107 · Red Hat ACM / multicluster-engine cluster-proxy (service-proxy impersonation headers)High
• Argo Workflows (workflow executor, artifact driver logging): The executor logs the whole artifact driver struct, so S3CVE-2026-42295 · Argo Workflows (workflow executor, artifact driver logging)High
• Argo Workflows (Argo Server, ConfigMap-backed sync limit provider): The Sync Service's ConfigMap provider runs noCVE-2026-42297 · Argo Workflows (Argo Server, ConfigMap-backed sync limit provider)High