Tetragon: unauthenticated gRPC API on localhost lets a same-node pod rewrite tracing policy

Impact

Tetragon's privileged gRPC API is exposed by a Helm default as an unauthenticated TCP listener on localhost:54321. Anything that shares the node's network namespace - any hostNetwork pod, or a compromised one - can call privileged methods with no credentials and add, delete or reconfigure tracing policies and debug settings. On a GPU fleet that means the runtime-enforcement layer itself can be silently disarmed: an attacker turns off the policies that would have flagged a container escape, then escapes. Because Tetragon runs as a privileged DaemonSet, reconfiguring it is a direct path to privilege escalation on the node, and the blinding is fleet-wide wherever the same Helm values were applied. Clusters that already moved the endpoint off TCP are unaffected.

Who can reach it

Local to the node, no authentication: any workload that can run or take over a hostNetwork pod on the same node reaches the loopback listener. Not reachable from off-node if the listener stays bound to localhost.

What to do

Upgrade to Tetragon 1.7.0, which defaults the gRPC endpoint to a Unix-domain socket, and roll the DaemonSet so every node picks it up - a Tetragon pod restart per node, no host reboot and no GPU workload drain. If you cannot upgrade now, set the server address to a Unix socket in your Helm values and restrict hostNetwork pod admission; the advisory states deployments that do not expose an unauthenticated TCP listener are not affected.

References

Related entries

• Portainer CE: non-canonical URL path defeats Docker proxy authorization, granting root on the Docker hostCVE-2026-72533 · Portainer CE (Docker API proxy authorization middleware)High
• Dokploy: WebSocket handlers skip per-server authorization, giving any org member root terminalsCVE-2026-72883 · Dokploy (WebSocket terminal, container-terminal, logs and stats handlers)High
• OpenChoreo: workflow parameters interpolated into sh -c run as commands in privileged build podsCVE-2026-73667 · OpenChoreo Workflow Plane (sample workflow templates, sh -c parameter interpolation)High
• OpenChoreo API: project-scoped users can exec into and read wirelogs of other projects' componentsCVE-2026-73841 · OpenChoreo openchoreo-api (component exec and wirelogs handlers)High
• KubeEdge CloudCore: unauthenticated node task status reports let anyone falsify node upgrade resultsCVE-2026-82473 · KubeEdge CloudCore (CloudHub HTTPS server, node task status endpoints)High
• CRI-O: restoring a malicious checkpoint keeps the source security context and bypasses pod policyCVE-2026-92574 · CRI-O (checkpoint/restore container restore path)High